Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

9/5/2019
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims

Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes.

One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety.

Now researchers at Tide — a nonprofit based in Sydney, Australia — have developed a similar approach to protecting usernames and passwords that they claim is some 14 million percent more difficult to hack than current mechanisms.

Tide's method, called "splintering," involves taking encrypted passwords within an authentication system, breaking them up into multiple tiny pieces, and storing the pieces on a decentralized distributed network from which they can be reassembled as needed.

Tide's Delegated Automated Trustee node technology makes it almost infinitely harder for attackers to reconstruct passwords using brute-force password guessing attacks, through reverse engineering and other techniques, according to the nonprofit.

In tests conducted using 60 million LinkedIn passwords that previously had been breached, Tide engineers discovered that splintering passwords reduced the odds of a dictionary attack succeeding from 100% to 0.00072%, an improvement over some 14.1 million percent, Tide claimed Thursday. The nonprofit has launched a campaign through which it is offering a reward to hackers who are able to break even a single username and password. So far, in 6.5 million attempts, not one hacker has been able to crack a single password, according to Tide.

Tide has implemented the new splintering technique in Tide Protocol, a collection of open source technologies it has developed to help organizations protect data better.

Yuval Hertzog, co-founder of Tide, says that within the Tide Protocol, encrypted passwords are splintered and stored over between 20 and 26 nodes on Tide's public blockchain. Each node — or Orchestrated Recluder of Keys, in the Tide Protocol — is tasked with processing the splinter assigned to it and to have the splinter assembled when requested. Only the node assigned to a splinter can decrypt it.

Configurable Security
Hertzog says the number of splinters that each encrypted password is broken up into is determined by the desired cryptographic strength and redundancy requirements of the organization. The minimum number is 20 nodes. "These parameters are configurable, allowing for customizable security and redundancy based on individual needs," he says.

The Tide scheme has been built in such a way that a splintered password can be fully recovered even if one or more of the nodes storing the splinters were to become unavailable for some reason. In fact, the model allows for up to 30% redundancy, meaning that a splintered password can be fully reassembled for authentication even if up to six nodes were to become unavailable, Hertzog says.

How scalable is the splintering approach when it comes to managing millions of passwords? Hertzog says the underlying architecture is based on an improved version of blockchain technology that already has been proven to support millions of users. "The specific implementation under the Tide Protocol has been load-tested to scale to several millions in a controlled environment," he says.

Tide engineers have introduced an intentional built-in 300 millisecond delay for each authentication request to mitigate brute-force and denial-of-service attacks on the network. But even with that, the latencies associated with splintering and reassembling passwords is on par with or even slightly better than existing commonly used authentication provider, Hertzog claims.

In public tests, end-to-end latency results showed the entire splinter-based authentication process to take between 1,500 milliseconds to 4,000 milliseconds with a full complement of nodes across Microsoft Azure, Google, and Amazon networks, he notes. "The splintering technology can be easily used in an almost identical manner to any of the existing OAuth2 authentication schemes and be integrated into any existing organization."

Tide's splintering approach is not available commercially yet. But organizations that want to kick the tires can find code and documentation for the technology on GitHub, where it is available under a special Tide Open Source License.

Tide describes itself as focused on protecting consumer data. Its members include cryptographers, tech entrepreneurs, economists, and media agency heads.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2019 | 9:52:03 AM
Re: Does it really help users?
HUGE need for user education here.  Do NOT use the same password for years at a time on the same 10 websites you use because it is easy to remember.  DO CHANGE it every month if you can.  A common construct syntax for variable passwords works great.  Two factor if they understand it.  
AlphegA
50%
50%
AlphegA,
User Rank: Apprentice
9/9/2019 | 8:58:38 PM
Re: Does it really help users?
This is a server side protection in an event the password database is breached.  This doesn't stop a compromised personal credentials.  Theres a few mechanism to mitigate those such as 2 factor authentication.  But that's not  going to help if your 2nd factor (email or device) is also compromised.   
Hackerproof Tech
50%
50%
Hackerproof Tech,
User Rank: Apprentice
9/6/2019 | 3:47:00 PM
Does it really help users?
Perhapd I fail to see how this would protect a  user password. Rather it seems to protect the server, meaning this process only makes it more difficult to crack a password but only if the password database were stolen, i.e. the server were compromised. But how does this protect a user who's personal credentials had been compromised. For example, someone gets access to my computer and learns my Dark Reading LI Credentials?  Or simply knows my login name and hits a server with a series of my PW from 'a list of my previously stolen passwords.' What am I missing?

 
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.