Hacker News Reader

Comment by chaosmachine | Hacker News Reader

Because you can see the color code at each step, it's easy to compare results very quickly, even by hand. Did I get letter 1 right? Ok, move on to letter two, try each key until the colors match the recording. Do this for each step. At most, you have to try about 64 key presses to crack each letter.

Also, because each step is only 1 character different, it's very unlikely that you will get collisions, even with a truncated md5 hash.

View on HN

It strikes me that this reduces password cracking to a game of Mastermind.

Amusement aside, it also allows a cracking attempt to be done without running up against server authentication. Even if the same series of color patterns can occur for multiple passwords, the quantity of attempted server authentications is greatly reduced.

It's actually easier than Mastermind, you only have to guess one character at a time.

This sounds like it would be easily fixed using a this-page-only salt for your hashing function. I.e., when someone else visits the login page, they get a different salt and thus can't use that attack. This could be done on the server (if you use a dynamically generated page) or on the client (with some javascript).

How do you know it's "someone else"? It's the login page, you don't know who you're displaying the page to yet.

And if you mean a different salt every time the page gets loaded: doesn't that completely skip the supposed point, which is to give the user a recognizable visual cue that they typed the right password?

The demo seems to highlight its use as a visual cue that your confirmed password is the same as the original. Not that useful in my opinion, as one attempt at creating an account with non-matching passwords will tell you they don't match anyway, and you (usually) only create an account once.

Still, pretty cool demo and very nice colour schemes.

Thank-you for the clear explanation.

Reply on news.ycombinator.com