The best way to protect passwords may be creating fake ones

A research project, NoCrack, creates plausible decoy password vaults to confuse attackers

Password managers are a great way to supply random, unique passwords to a high number of websites. But most still have an Achilles' heel: Usually, a single master password unlocks the entire vault.

But a group of researchers has developed a type of password manager that creates decoy password vaults if a wrong master password is supplied.

A paper on the experimental software, called NoCrack, will be presented on May 19 at the IEEE Symposium on Security and Privacy in San Jose, California.

NoCrack is intended to make it much more time-consuming and difficult for attackers to figure out if they've hit pay dirt.

"As an attacker, you have no idea which vault is the real one," said Rahul Chatterjee, a master's student at the University of Wisconsin in Madison, and co-author of the paper. "He is left with no other option but to try the passwords on websites."

One of the problems with password managers is that they store all of their passwords in an encrypted file. That file -- if stolen from a victim's computer -- can then be subjected to so-called brute force attacks, in which hundreds of thousands of passwords are tried in quick succession.

If an incorrect password is entered, it's easy for an attacker to know it's wrong. The file that is generated is junk, Chatterjee said, and the attacker doesn't have to bother trying the credentials at an online web service.

NoCrack generates a plausible-looking password vault for every wrong guess, an unlimited number of decoys. The only way to figure out if the credentials are accurate is to try them online.

That approach "is costly and slow," he said.

Since most online services limit the number of password guesses, attackers wouldn't get many chances to ferret out the decoy vaults, Chatterjee said.

NoCrack isn't the first attempt to try this approach. Another system, called Kamouflage, is similar, but Chatterjee said his team found a weakness in how it generates decoy master passwords.

Kamouflage's decoy master passwords are based on the real master password. Studying the decoy passwords actually helps an attacker learn the structure of the real password, allowing the true one to be more easily discovered. The NoCrack team looked to create better decoy vaults.

To do that, NoCrack uses natural language encoding (NLE) algorithms, which ironically have also been used by people trying to crack passwords. NLE algorithms decode a uniformly selected bit string and generate a fresh sample of natural language text, according to the paper.

The researchers found that using NLE made NoCrack resistant to simple machine-learning attacks aimed at sifting the real vault from the fake ones.

There is, however, one large problem: What if a person mistypes a password? In that scenario, a fake vault is generated, and a user is locked out of his or her accounts.

Chatterjee said they're working on solutions. One possible fix is to create a hash of the master password that is linked to an image that is shown when the password is entered. The authorized user should recognize when the wrong image is displayed, but an attacker would not. Another possibility would be to auto-correct the password if it is just slightly off, he said.

There are no plans as of yet to commercialize NoCrack, Chatterjee said. The paper was also co-authored by Joseph Bonneau, Ari Juels and Thomas Ristenpart.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags no companysecurityAccess control and authentication

More about IEEE

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place