1
$\begingroup$

I had the idea of converting map locations into passwords. Basically Jumblar (github.com/micheal-swiggs/jumblar) takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) currently is only 2-bytes long. Each time the user wishes to use that location to generate passwords, they will first attempt supply a guess location. Jumblar then spirals around this guess location until it finds the point with the same hash.

Jumblar then uses this location as the basis for password generation. The user will add a 'spice' e.g username@email.com that Jumblar will use to generate a password. So rather than the user remembering a map location for each password, they only need to remember one location and a list of spices. Currently I'm assuming that is fine to store the spice(s) in open storage. So long as the map location remains a secret, the passwords derived from the spice(s) are 'safe'.

When Jumblar (github.com/micheal-swiggs/jumblar) generates a password there is a guarantee that it will contain atleast - one lowercase, one uppercase and one numeric - character.

Vague Hash

Jumblar only does a vague-hash of the secret location. Rather than storing the entire location hash on the PGP network, Jumblar only stores between 2-3 bytes of hash material. So a potential cracker could only discover a set of possible points that correspond to the vague-hash. The vague-hash is only used to distinguish the secret location from immediately surrounding locations. If the user guesses a location far away from the actual location, then Jumblar is likely to match an incorrect location.

A review and/or comments of the 'idea' and even the project would be greatly appreciated.

Salt & Master Password

The user must also remember a 'master' password and a salt accompanies each vague-hash. So the vague-hash is a result of hashing upon the secret location, password and salt.

$\endgroup$

closed as off-topic by e-sushi Dec 7 '17 at 4:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ The entropy contained in a single location is pretty low, so the generated password might be weak. $\endgroup$ – CodesInChaos Jul 19 '13 at 7:30
  • 1
    $\begingroup$ Especially with the hash of the location being available (stored as a comment on the PGP network, see first sentence), exhaustive search of the location is going to be quite easy (do the search spiraling away from the user's home for improved efficiency). Once you have that, guess the "spice" and recover the password. $\endgroup$ – minar Jul 19 '13 at 7:51
  • $\begingroup$ Thanks, I should have mentioned that the stored hash is only 2-bytes long. So an attacker would only know a set of suitable locations. The intention of the stored hash is to only store enough information to distinguish the 'secret location' from surrounding locations. $\endgroup$ – Kurent Jul 19 '13 at 7:56
  • 1
    $\begingroup$ Your "vague hash" should be replaced with a secure sketch. $\:$ $\endgroup$ – user991 Jul 19 '13 at 8:31
  • 3
    $\begingroup$ I don't know. If I don't know the location then I'm not that likely to remember it. If I do choose a known location then there is a big chance that an attacker would guess the right location. Many people are really bad at reading maps too. Seems to me that this is only good for thwarting attacks from geographically challenged attackers. $\endgroup$ – Maarten Bodewes Jul 19 '13 at 14:00