5

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master password on LastPass.

However, the simple nature of ciphers and encoding schemes like Base64 and how easily a system trained to do so would be able to crack them makes me wonder whether this isn't some form of security by obscurity.

Just how much more secure is this practice compared to simply using a long plain text master password? Is it good or bad security practice? Are there likely to be hackers out there that make the decoding of basic ciphers and encoding schemes part of their brute-forcing strategy?

Hashim Aziz
  • 969
  • 8
  • 21

1 Answers1

5

"and then use the result as their master password on LastPass"

The proposed "algorithm" is in essence just a fancy key expansion.

As you surmised, it is security through obscurity. If one knew that I was using a base64 encoding of a plaintext crunched through (say) Bifid, he would be able to brute force the database much faster: the plaintext would probably be no more than four or five words, giving somewhere between 50 and 70 bits of information, not as if it was a real 100-bit sequence.

On the other hand, 50 to 70 bits of information is pretty good for a password (see mandatory xkcd link). So if you started with a secure choice, you'd stay secure.

On the gripping hand, good password managers allow for any length of master password. So I could choose a lengthier text of my choice, and that could be both easier to regenerate and better security. I can't run Bifid with pencil and paper every time I need to unlock my password manager.

And if one chose a single word, insecurely, trusting in the magic of base64 to enhance its hardness? If that became known, a password database could be blown open in a few minutes. So, depending on who's given to, it might even be a very bad suggestion.

funny factoid

A colleague told me that, apparently, this kind of - not "fallacy", let's say "inefficiency" - might be called Feynman's Yellow Paint. The story goes that a painter claimed to be able to get yellow paint by mixing red and white, while Feynman held this was not possible. They proceeded with the experiment, and the white-red mixture turned pink -- and stayed pink. So the painter commented, "Usually I added some yellow, and then it turned out fine".

The analogy here is that to get a strong password from a base64'ed ciphered scheme, you need to start with a strong password. But if you have a strong password, then you do not need the cipher and encoding superstructure.

LSerni
  • 22,521
  • 4
  • 51
  • 60