Surf Wiki
Save to docs
general/password-authentication

From Surf Wiki (app.surf) — the open knowledge base

Partial password

Partial password
A partial password entry form in a mobile banking application

A partial password is a mode of password authentication intended to make keystroke logging and shoulder surfing less effective.

By asking the user to enter only a few specific characters from their password, rather than the whole password, partial passwords help to protect the user from password theft. As only part of the password is revealed at once it becomes more difficult to obtain the password using techniques such as keystroke logging or shoulder surfing.

A paper by David Aspinall and Mike Just describes partial password implementations and attacks in a detailed study.

Tested with 110,000 simulations using passwords longer than 8 characters long, Junade Ali has noted:

  • 58% of passwords are revealed in entirety after 7 logins, 90% after 12 and 99% after 19 logins.
  • Using a dataset of 488,129 breached passwords, 58% of tested 3-character password segments were only valid for that password in the database. Additionally, 28% could be associated with only one other password and 8% with two other passwords.

Verifying partial passwords

It is considered good practice to not store passwords in plaintext. Instead, when checking a whole password, it is common to store the result of passing the password to a cryptographic hash function. As the user does not supply the whole password, it cannot be verified against a stored digest of the whole password. Some have suggested storing the digest of each combination of letters that could be requested, but they note that this results in generating and storing a large amount of digests. A better solution in terms of storage space and security is using a secret sharing scheme.

References

References

  1. ""Give Me Letters 2, 3 and 6!": Partial Password Implementations & Attacks".
  2. "What is partial password verification?". [[The Co-operative Bank]].
  3. (20 December 2018). "Banking-Grade Credential Stuffing: The Futility of Partial Password Validation".
  4. [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html Password storage]
  5. "Partial Passwords and Keystroke Loggers".
  6. "Partial Passwords Done Right".
  7. [http://www.smartarchitects.co.uk/news/22/67/Update-to-Partial-Passwords.html Update to Partial Passwords]
Wikipedia Source

This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page.

password-authentication
Want to explore this topic further?

Ask Mako anything about Partial password — get instant answers, deeper analysis, and related topics.

Research with Mako

Free with your Surf account

Content sourced from Wikipedia, available under CC BY-SA 4.0.

This content may have been generated or modified by AI. CloudSurf Software LLC is not responsible for the accuracy, completeness, or reliability of AI-generated content. Always verify important information from primary sources.

Report