Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

9/5/2019
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims

Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes.

One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety.

Now researchers at Tide — a nonprofit based in Sydney, Australia — have developed a similar approach to protecting usernames and passwords that they claim is some 14 million percent more difficult to hack than current mechanisms.

Tide's method, called "splintering," involves taking encrypted passwords within an authentication system, breaking them up into multiple tiny pieces, and storing the pieces on a decentralized distributed network from which they can be reassembled as needed.

Tide's Delegated Automated Trustee node technology makes it almost infinitely harder for attackers to reconstruct passwords using brute-force password guessing attacks, through reverse engineering and other techniques, according to the nonprofit.

In tests conducted using 60 million LinkedIn passwords that previously had been breached, Tide engineers discovered that splintering passwords reduced the odds of a dictionary attack succeeding from 100% to 0.00072%, an improvement over some 14.1 million percent, Tide claimed Thursday. The nonprofit has launched a campaign through which it is offering a reward to hackers who are able to break even a single username and password. So far, in 6.5 million attempts, not one hacker has been able to crack a single password, according to Tide.

Tide has implemented the new splintering technique in Tide Protocol, a collection of open source technologies it has developed to help organizations protect data better.

Yuval Hertzog, co-founder of Tide, says that within the Tide Protocol, encrypted passwords are splintered and stored over between 20 and 26 nodes on Tide's public blockchain. Each node — or Orchestrated Recluder of Keys, in the Tide Protocol — is tasked with processing the splinter assigned to it and to have the splinter assembled when requested. Only the node assigned to a splinter can decrypt it.

Configurable Security
Hertzog says the number of splinters that each encrypted password is broken up into is determined by the desired cryptographic strength and redundancy requirements of the organization. The minimum number is 20 nodes. "These parameters are configurable, allowing for customizable security and redundancy based on individual needs," he says.

The Tide scheme has been built in such a way that a splintered password can be fully recovered even if one or more of the nodes storing the splinters were to become unavailable for some reason. In fact, the model allows for up to 30% redundancy, meaning that a splintered password can be fully reassembled for authentication even if up to six nodes were to become unavailable, Hertzog says.

How scalable is the splintering approach when it comes to managing millions of passwords? Hertzog says the underlying architecture is based on an improved version of blockchain technology that already has been proven to support millions of users. "The specific implementation under the Tide Protocol has been load-tested to scale to several millions in a controlled environment," he says.

Tide engineers have introduced an intentional built-in 300 millisecond delay for each authentication request to mitigate brute-force and denial-of-service attacks on the network. But even with that, the latencies associated with splintering and reassembling passwords is on par with or even slightly better than existing commonly used authentication provider, Hertzog claims.

In public tests, end-to-end latency results showed the entire splinter-based authentication process to take between 1,500 milliseconds to 4,000 milliseconds with a full complement of nodes across Microsoft Azure, Google, and Amazon networks, he notes. "The splintering technology can be easily used in an almost identical manner to any of the existing OAuth2 authentication schemes and be integrated into any existing organization."

Tide's splintering approach is not available commercially yet. But organizations that want to kick the tires can find code and documentation for the technology on GitHub, where it is available under a special Tide Open Source License.

Tide describes itself as focused on protecting consumer data. Its members include cryptographers, tech entrepreneurs, economists, and media agency heads.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2019 | 9:52:03 AM
Re: Does it really help users?
HUGE need for user education here.  Do NOT use the same password for years at a time on the same 10 websites you use because it is easy to remember.  DO CHANGE it every month if you can.  A common construct syntax for variable passwords works great.  Two factor if they understand it.  
AlphegA
50%
50%
AlphegA,
User Rank: Apprentice
9/9/2019 | 8:58:38 PM
Re: Does it really help users?
This is a server side protection in an event the password database is breached.  This doesn't stop a compromised personal credentials.  Theres a few mechanism to mitigate those such as 2 factor authentication.  But that's not  going to help if your 2nd factor (email or device) is also compromised.   
Hackerproof Tech
50%
50%
Hackerproof Tech,
User Rank: Apprentice
9/6/2019 | 3:47:00 PM
Does it really help users?
Perhapd I fail to see how this would protect a  user password. Rather it seems to protect the server, meaning this process only makes it more difficult to crack a password but only if the password database were stolen, i.e. the server were compromised. But how does this protect a user who's personal credentials had been compromised. For example, someone gets access to my computer and learns my Dark Reading LI Credentials?  Or simply knows my login name and hits a server with a series of my PW from 'a list of my previously stolen passwords.' What am I missing?

 
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
CVE-2019-6650
PUBLISHED: 2019-09-20
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVE-2014-10396
PUBLISHED: 2019-09-20
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.