Improving the Security of Your User Passwords in PHP with Ultra Paranoid Computing - PHP Paranoid Passcode package blog

What is Ultra-Paranoid Computing

Rubber Hose Resistant Passwords

What You Don't Know

The Paranoid Passcode Package

Conclusion

Introduction

I first ran across the concept of Ultra-Paranoid Computing in a short segment on Nova's program Rise of the Hackers, featuring Dr. Patrick Lincoln. The most memorable part was researchers sitting around in their lab all day playing guitar hero, how can I get that gig? As I contemplated the work behind the playtime, I found it to be quite interesting.

What is Ultra-Paranoid Computing

As I understand it, Ultra-Paranoid Computing is security research based on the idea that every device can and will be compromised. This leaves a big question to be answered, exactly how does any system know just who is on the other end of the line?

We currently use authentication factors to determine how secure an authentication system is, ranging from what you know, to what you have, and finally ending up with what you are. If you are not familiar with these factors, you can read more in this other article.

Rubber Hose Resistant Passwords

No matter how secure a system may seem, there is always one weak link, and that is the human factor.

Complex passwords are too hard to remember, so they are written down, support services meant to help users wind up helping imposters breach security, and of course, to the ultra paranoid, there is always the possibility that you may be beaten with a rubber hose until you give up your secret access code.

How do you get around the human factor? You use an authentication system that is even more secure than bio-metrics, I will call it the what you don't know factor.

What You Don't Know

Consider the saying that practice makes perfect. No matter what we are doing, if we practice enough we will improve and eventually it will be second nature to us.

The project researchers used, learning to play a song on the guitar as their example. Playing the song is a progression of rhythmic notes that you must practice over and over until you can play it without even thinking about it

This is training your muscle memory and once you reach the point that you do not need to think about it anymore, you are using this muscle memory to perform the song, not conscious thought.

Some will argue that this is what you know, you just know it really well. I say that an authentication code consisting of a long set of different key presses in a set rhythm that a user can perform without even thinking about it is much more than what you know.

The user can't write it down for someone to find, third parties can't reveal it and if you break my fingers to get me to talk, you are still going to have to take the time to learn it yourself.

The Paranoid Passcode Package

This PHP Paranoid Passcode package will generate a passcode using a secret key and mapping it to the number pad keycodes on a standard keyboard.

It will also generate the rhythm, the time paused between key presses, which combined with the passcode will make a very secure authentication system. It comes with the trainer to help you practice the passcode until it becomes part of your muscle memory.

Here is quick example to instantiate the package and generate the passcode/rhythm pair.

include('parapass.class.php');

$para = new paraPass();

//passcode length
$passLength = 30;
$passcode = $para->generatePasscode($passLength);
$rhythmString = $para->generateRhythm($passLength);

Conclusion

Keep in mind that Ultra-Paranoid Computing is in the experimental stages. Realistically, how many users will take the time necessary to train their muscle memory with a passcode?

Right now our users expect everything with as little hassle as possible. As more and more private information becomes public and users become more security savvy and paranoid, what they don't know may become the next official authentication factor.

If you liked this article or you have a question regarding implementing Ultra-Paranoid Computing in PHP, post a comment here.