Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

9/5/2019
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

New Technique Makes Passwords 14M Percent Harder to Crack, Nonprofit Claims

Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes.

One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety.

Now researchers at Tide — a nonprofit based in Sydney, Australia — have developed a similar approach to protecting usernames and passwords that they claim is some 14 million percent more difficult to hack than current mechanisms.

Tide's method, called "splintering," involves taking encrypted passwords within an authentication system, breaking them up into multiple tiny pieces, and storing the pieces on a decentralized distributed network from which they can be reassembled as needed.

Tide's Delegated Automated Trustee node technology makes it almost infinitely harder for attackers to reconstruct passwords using brute-force password guessing attacks, through reverse engineering and other techniques, according to the nonprofit.

In tests conducted using 60 million LinkedIn passwords that previously had been breached, Tide engineers discovered that splintering passwords reduced the odds of a dictionary attack succeeding from 100% to 0.00072%, an improvement over some 14.1 million percent, Tide claimed Thursday. The nonprofit has launched a campaign through which it is offering a reward to hackers who are able to break even a single username and password. So far, in 6.5 million attempts, not one hacker has been able to crack a single password, according to Tide.

Tide has implemented the new splintering technique in Tide Protocol, a collection of open source technologies it has developed to help organizations protect data better.

Yuval Hertzog, co-founder of Tide, says that within the Tide Protocol, encrypted passwords are splintered and stored over between 20 and 26 nodes on Tide's public blockchain. Each node — or Orchestrated Recluder of Keys, in the Tide Protocol — is tasked with processing the splinter assigned to it and to have the splinter assembled when requested. Only the node assigned to a splinter can decrypt it.

Configurable Security
Hertzog says the number of splinters that each encrypted password is broken up into is determined by the desired cryptographic strength and redundancy requirements of the organization. The minimum number is 20 nodes. "These parameters are configurable, allowing for customizable security and redundancy based on individual needs," he says.

The Tide scheme has been built in such a way that a splintered password can be fully recovered even if one or more of the nodes storing the splinters were to become unavailable for some reason. In fact, the model allows for up to 30% redundancy, meaning that a splintered password can be fully reassembled for authentication even if up to six nodes were to become unavailable, Hertzog says.

How scalable is the splintering approach when it comes to managing millions of passwords? Hertzog says the underlying architecture is based on an improved version of blockchain technology that already has been proven to support millions of users. "The specific implementation under the Tide Protocol has been load-tested to scale to several millions in a controlled environment," he says.

Tide engineers have introduced an intentional built-in 300 millisecond delay for each authentication request to mitigate brute-force and denial-of-service attacks on the network. But even with that, the latencies associated with splintering and reassembling passwords is on par with or even slightly better than existing commonly used authentication provider, Hertzog claims.

In public tests, end-to-end latency results showed the entire splinter-based authentication process to take between 1,500 milliseconds to 4,000 milliseconds with a full complement of nodes across Microsoft Azure, Google, and Amazon networks, he notes. "The splintering technology can be easily used in an almost identical manner to any of the existing OAuth2 authentication schemes and be integrated into any existing organization."

Tide's splintering approach is not available commercially yet. But organizations that want to kick the tires can find code and documentation for the technology on GitHub, where it is available under a special Tide Open Source License.

Tide describes itself as focused on protecting consumer data. Its members include cryptographers, tech entrepreneurs, economists, and media agency heads.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Hackerproof Tech
50%
50%
Hackerproof Tech,
User Rank: Apprentice
9/6/2019 | 3:47:00 PM
Does it really help users?
Perhapd I fail to see how this would protect a  user password. Rather it seems to protect the server, meaning this process only makes it more difficult to crack a password but only if the password database were stolen, i.e. the server were compromised. But how does this protect a user who's personal credentials had been compromised. For example, someone gets access to my computer and learns my Dark Reading LI Credentials?  Or simply knows my login name and hits a server with a series of my PW from 'a list of my previously stolen passwords.' What am I missing?

 
AlphegA
50%
50%
AlphegA,
User Rank: Apprentice
9/9/2019 | 8:58:38 PM
Re: Does it really help users?
This is a server side protection in an event the password database is breached.  This doesn't stop a compromised personal credentials.  Theres a few mechanism to mitigate those such as 2 factor authentication.  But that's not  going to help if your 2nd factor (email or device) is also compromised.   
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/12/2019 | 9:52:03 AM
Re: Does it really help users?
HUGE need for user education here.  Do NOT use the same password for years at a time on the same 10 websites you use because it is easy to remember.  DO CHANGE it every month if you can.  A common construct syntax for variable passwords works great.  Two factor if they understand it.  
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18954
PUBLISHED: 2019-11-14
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious at...
CVE-2019-3640
PUBLISHED: 2019-11-14
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.
CVE-2019-3661
PUBLISHED: 2019-11-14
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.
CVE-2019-3662
PUBLISHED: 2019-11-14
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
CVE-2019-3663
PUBLISHED: 2019-11-14
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system.