Archive notice: This article was originally published on June 12, 2008. Links and embedded videos are preserved as part of the historical record.
Passwords are easy to forget, and writing them down is hardly the ideal solution. But now they can be stored on a mobile phone with genuine security, simply and affordably. Researchers at the Fraunhofer Institute for Secure Information Technology SIT in Darmstadt have launched their download portal, http://www.mobilesitter.de, where anyone can obtain a €9.90 program for Java-enabled mobile phones that securely manages any number of passwords. Users need remember only one master password to activate “MobileSitter.”
The license remains valid for one year and must then be renewed. If users change devices, they can download and install other software versions free of charge at any time.
“What was my password again?” “What was my PIN?” Almost everyone has asked these questions when the secret combinations simply would not come to mind. Especially after a vacation, when passwords have not been entered for several days, they can often be impossible to remember. This now-ubiquitous password dilemma affects not only computer specialists, but everyone who uses a computer professionally or privately, browses the Internet, or carries debit or credit cards in their wallet.
$$$$
Dictionary Attacks Do Not Help
The Fraunhofer researchers have developed a password-storage method that, when used correctly, is resistant to hacker attacks using so-called dictionary lists. If a phone thief enters the wrong master password, MobileSitter calculates a password on that basis—for example, a four-digit PIN (Personal Identification Number) for a debit card at an ATM. Unfortunately for the thief, this PIN is wrong, even though it looks genuine. The same applies to stored passwords.
The MobileSitter software was developed in Java for mobile devices such as phones and PDAs. Because mobile devices have become constant companions, users always have their secret combinations at hand. A PC version of the software has been announced that will allow users to synchronize their confidential data between a PC and mobile device.
“With MobileSitter, we send the attacker down a dead end,” reports Dr. Markus Schneider, who is responsible for innovation management at Fraunhofer SIT. If any master password is accepted and false individual passwords are then supplied, the thief will have a problem at the ATM at the latest—after three incorrect entries, the account is blocked entirely and the card retained, preventing any theft. “To ensure that the password owner does not fall into the same trap after mistyping the master password, however, we have built in another security mechanism. Anyone who enters the master password correctly is shown an image as confirmation. They must remember which image is the correct one, enabling them to recognize a typing error and enter the master password again.” The thief is also shown an image, but of course does not know whether it is the right one.
$$$$
Schneider advises caution with other password stores that save passwords in encrypted form on computers and require users to remember only a master password for encryption and decryption, “because freely downloadable hacking tools that perform dictionary attacks are available on the Internet.” Dictionary attacks simply try millions of master passwords, something that today’s ordinary PCs can do in a very short time. Access is denied for incorrect candidates.
Once the correct master password is found, however, all stored secret combinations are immediately accessible. The difference from MobileSitter is that in other systems both hacking programs and hackers themselves can immediately recognize when they have found the right password. “In practice, dictionary attacks can also break other password stores, even when they use strong encryption methods,” Schneider says.
In addition to access to the MobileSitter shop, the http://www.mobilesitter.de portal provides detailed information about the technology and the mobile phones on which MobileSitter works.
Further Links:
- More information
More information
