# Secrets over the phone [closed]

Let's say, for instance, your friend needs one of your passwords to do something while you're away. He calls you and asks for it. Thing is, you don't want him to know your password.

How then would you allow him to enter said password with only a keyboard and the phone in his hand, without him knowing the password?

• Is this even possible? He would have to physically type in the password, so no matter what, he would still know the password... – Josh Mar 7 '15 at 7:02
• You could do something kind of like this if the application in question has special support for it, like a login based on zero-knowledge proofs, but for a procedure that ends up with the actual password entered into a text field, there seem to be too many avenues of attack. Keylogging could store the keystrokes, the procedure could be performed into Notepad instead of the actual password input, you could copy-paste the password out of the text field, etc. Are we assuming the friend also doesn't want to know the password? – user2357112 supports Monica Mar 7 '15 at 7:51
• What device are you protecting with a password – IHaveAQuestion Mar 7 '15 at 17:08
• Do you mean without him knowing the password beforehand? I guess this problem is underspecified. – Palec Mar 7 '15 at 20:17
• Set to loudspeaker and say Parseltongue voice-to-text-password. – Septian Primadewa Mar 8 '15 at 2:41

Coming from a security background, several options come to mind real quick:

1) Have him enter a one-time password/code/phrase (OTP). (OpenID providers such as any site that supports or provides a "Sign in with ....." use this.) Then delete or change the (normally) 10 passphrase once he has entered this one.

2) Use Oauth or OpenID again, but using QRcodes or pseudo-random gibberish as alluded to by Duncan, only instead of the delete/modify it uses the QR code on his tablet/phone

3) Using a keychain in the browser or OS (assuming multiple accounts -- a couple of dummy accounts), have him select the username in question. The password is hashed out (******), they hit enter, you change promptly.

• This give me the idea of creating a account on a openid provide you dont really use, attach it to the one he needs to login with, after he is logged in remove the first account. – Sven van den Boogaart Mar 8 '15 at 11:02

Answer in parts so people can guess the rest as they go along.

Assuming you both have smartphones, have your friend turn the camera on for video chat and close his eyes

Then he can hold the phone over the keyboard so you can see the keyboard on your phone through the video chat

He randomly places his finger on the keyboard and you direct him to move his finger to the next letter in your password, one letter at a time (I.e. If his finger lands on the "u" and the next letter is a "v" you direct him to go left, down/left, down/left.

requirements:

This requires that you trust your friend to keep his eyes closed and that he does not start on one of the "home" keys, f or j (in a qwerty keyboard) that have little ridges on them for identification. Or that if one of the home keys is in your password, you have him reset his finger afterwards

• I realized right before falling asleep last night that this method may be complicated by capital letters and symbols, but it would still mostly work. You'd just need to tell your friend when to capitalize and he'd put the phone down and find the shift key with his phone hand. – Duncan Mar 7 '15 at 14:49
• This seems to be far far too much trouble for its worth. Unless you also open a second videoconferencing channel to monitor that his eyes are closed, the level of trust required makes it similar to just giving the password. Furthermore, a determined attacker could install a keylogger (perhaps whitelisted from the antivirus) and therefore obtain your password while appearing to follow your arbitrary rules perfectly. – March Ho Mar 7 '15 at 17:10
• Well sure, but nothing in the puzzling.se guidelines say the puzzle situation needs to make sense. I was trying to answer the question from a puzzling perspective and not a technological one as many of the other answers seem to be. – Duncan Mar 7 '15 at 18:14
• @MarchHo Well, just to be fair you would need three video feeds as you would also need to see the screen to make sure you're actually typing in a password field and not notepad. – David Mulder Mar 8 '15 at 1:28

I'm assuming the main point is that the friend not learn your password, because maybe it is also used for some more sensitive purposees. You could do this for most websites by logging in on your own computer, and then sending (I guess reading aloud, which would take some time) your session credentials to your friend. These are usually stored in a browser cookie.

Friend inserts these session credentials artificially into her browser, and it just looks to the server as though your logged-in laptop just changed IP addresses.

For many sites, this would allow your friend to be logged in as you, and perhaps even change your password, but probably not ever see the actual password.

• Well, a well designed auth system should lock a session to an IP (specifically to prevent very thing: session stealing (though in that case through XSS attacks)), so I doubt this could work in that many places. – David Mulder Mar 8 '15 at 1:29
• chrome 40+ / firefox 35+ / safari (Yosemite & 8.0.x versions) do this – linuxdev2013 Mar 8 '15 at 12:46
• @DavidMulder So your system would require me to relogin every time I get a new IP? Changing WifiHotspot, travelling across networks with my phone, rebooting the next morning??? What about "keep me logged in please" ? – Falco Mar 8 '15 at 17:17
• @Falco Obviously. Most places in the world have semi-fixed or fixed IP's, so in general it's not much of a UX problem and it's a huge gain for security. – David Mulder Mar 8 '15 at 17:22
• @DavidMulder Sorry - I think I forgot to specify the kind of sites, where such a policy might be useful. You are right: If I have a high security page like online banking, where the user is usually logged out after 10min inactivity, password is not stored in the browser and is not often accessed on public networks, an IP filter seems reasonable. Also the user is unlikely to change to competition because of inconvenience in this. On pages like stack-overflow/facebook/... where you usually always keep logged in on all your devices, an ip-change should keep your session intact ;) – Falco Mar 11 '15 at 15:11

Have him change the key layout to Dvorak first. Then tell him which letters to type on the normal layout. E.g, if your password is "horse staple", you'd have him type "jso;d ;karpd".

Of course, this relies on him not typing into a text editor, nor remembering the random sequence of letters to translate later.

You could embed your actual password inside some random string and them tell him to type that random string, which you could make as complicated and as long as you want.

For e.g. if your password is abc123 then you could tell him to type, lets say this - gibarisbhc3\$%&1st2u5f3.

It really doesn't matter what random string you choose to say, so long as it contains all the characters in your actual password appearing in that same order.

Now its just a matter of making him delete the unwanted characters from that random string such that only your password remains in the password field before he presses the enter key to log in to the machine.

In the e.g. above there are 16 unwanted characters that needs to be removed and lets say we choose the method in which we will remove them starting from the rightmost character. You could also adopt some other complex methods (like for e.g. first odd ones and then even ones) of deleting to make things more complicated, in case your friend has a nearly eidetic memory.

Remember that the cursor would be at the end of the last character before the deletion process starts. I'm saying this because you could actually add more complication by not starting from the end (for instance just tell him to press the Home button which would take the cursor to the start). OK so the first unwanted character that needs to be deleted in our adopted method of deletion would be the last f. This can be done by telling him to press the left arrow once and then hit backspace and so on and so forth for the remaining unwanted characters. So it would be nearly impossible for someone to figure out the actual password, assuming he is not writing the password and is simply typing it as you say it on the phone.

P.S. You could also make use of the Insert key during the deletion process to add one more layer of complication.

• If I did this process in a text editor window instead of the password field, I'd get to see the result, regardless of how complicated the process. – Alex Mar 7 '15 at 12:25

Another technique that has not yet been mentioned would be to change your password, give it to your friend, and then change it back after he is done with the task (in most competently designed systems, this should invalidate all current login tokens and therefore kick the user out of the system).

However, all of the above techniques all render your friend (whom you presumably don't want to give full account access) capable of full control over your account, at least for a limited amount of time, in a state where you have no oversight over his/her actions.

One way which prevents these avenues of attack would be to let your friend open a secured VNC tunnel to your computer, which has the account already logged in. This way, you can monitor whatever actions are taken, and be able to disconnect said friend if they attempt to do anything that you do not allow.

You can obfuscate the password using backspaces and arrows. For example, if my password is "Steve", I could tell him to type:

xS{left}{backspace}{right}t... etc. Hopefully you get the idea, I'm too lazy to give a full example!

Of course, if he types it into a plain text field, he would still see the password, so probably go on speaker and use facetime or something to watch as he types it directly into a password field.

To mitigate against someone listening on the line, you could utilize some shared secrets, like "press {left} {your daughter's age} times".

Not the most secure way, but it is possible for them to let you log in via some from of remote desktop connection, and then you type it in somewhere where it hides the characters with * or similar - note that this is would be susceptible to a software keylogger, possibly browsers saving passwords, they would see the length, etc.

But one really usefull idea is create a pression group (aka lobbying) to incentivize big e-mail providers to create one-way (single use, aka disposable) timed (good only for 5 minutes) restricted (only receive or only send up to a limited number e-mails) passwords!

So, you need a friend do access your e-mail account. Ok, give him/her a disposable password that is only good for send/receive e-mail up to the five minutes period with no access to the account settings.

Some one could get rich making things this way :).

Anything else mentioned is a crude adventure to be doomed to failure.