Funk turns ‘fido’ into gobbledygook

Everyone is always urging you to employ stronger passwords. Everyone, that is, whose job it is to implement or enforce security. Users, on the other hand, like to use short, easy to remember passwords – name of a pet, something written on the wall in their office (like “April”), their own middle name, etc. Security says the password should be “i424YO8MCjIss1zU,” the user wants it to be “fido.” Funk Software thinks you can have both.

Funk is best known for its steel-belted RADIUS product. Originally used to validate and authenticate dial-in users, RADIUS (which used to stand for Remote Authentication Dial-In User Service) is now also a big part of access control for those reaching out to your network across the public Internet. Funk Software has just released, for free, the Password Amplifier.

This little applet can turn “fido” into “i424YO8MCjIss1zU” in a few seconds. It does this by taking your input (“fido”) and hashing it over a million times. “Hashing” is the process of applying a numeric transformation to the value of the selected password. This is analogous to the pseudo-random number generator available in most programming languages in that if you start with the same value, you’ll always get the same result. But since Password Amplifier does over a million hashes, a slight change in the source password can make a major change in the output. Starting with “fido” results in “i424YO8MCjIss1zU,” as we saw above. But capitalize the word so that it’s “Fido” and the result becomes “D4ly4jUpwxSOt6y1.”

This isn’t the last word in password protection, by a long shot. It’s intended to protect your password from a dictionary attack.

“Dictionary attack”: a cracker who knows or guesses your username tries every word in a dictionary as possible passwords. A typical dictionary attack might proceed by trying all words in an actual dictionary. The Oxford English Dictionary contains fewer than a million words, and an attacker could try all of them in seconds.

Well, you say, what’s to stop the cracker from using Password Amplifier with the dictionary to get the hash values of all the words? There’s nothing to stop the cracker from doing this. It would take a fair amount of time, but it probably could be automated. Since capitalization counts, the cracker would need to generate hashes for the words spelled as all lower case, all upper case and capitalized – at a minimum. But Funk also offers another twist, which should thwart even the most ambitious cracker.

You can create a “salt” with Password Amplifier. A salt is a phrase that is first used to mathematically transform the password. The result is then hashed over a million times to create the final value. Starting with “fido” once again, the salted, hashed result is now “b34iiXrVb4wvdFTs” (I used the phrase “my editor is a wonderful person” as a salt. No particular reason, and it’s something that would be hard to guess since few writers think of any editor as “wonderful”! Of course, in this case the statement is absolutely true.)

If you download Password Amplifier (https://www.funk.com/Download/PassAmp.msi), start with “fido” and use the salt “my editor is a wonderful person,” you should also get the result “b34iiXrVb4wvdFTs.” No need to remember the strong password, then, as you can re-run Password Amplifier whenever you need to.

As I said, this isn’t the last word in password management, but it is useful. And it is free.