Slashdot Mirror

This is very good idea. There is a commercial solution, in which you choose from palate of faces. Here is a link: http://www.realuser.com/
Perhaps there is open/free implementation (or even something like gdm/kdm/xdm with this kind of identification).
If some of you knows something like this let as know.

I did some research on usability analysis for "Face PIN" (face number don't make sense but anyway), which does not replace the PIN but instead it helps you reconstruct the number using a grid of faces. It seems that people tend to remember faces quite easily. It will also eliminate any social engineering since your faces cannot be communicated verbally. One scheme is to use 4 different grids of numbered faces where each face represents one digit in your PIN. Those grids can be placed on the back of your credit card. There are drawbacks and solutions as such, ofcourse but I'm not going to mention now. Check this site which has a similar scheme about faces: http://www.realuser.com/

Face PIN is already patented, I'm just doing the usability analysis.

Was PassFaces., unfortunatly its a propritary product, but a pretty good idea. Not without its faults though.

Not sure if this is what you mean, but it sounds like it might be.

http://www.realuser.com/cgi-bin/ru.exe/_/homepages /users/passface.htm

Passfaces uses a similar idea; you can remember the faces that make up your password, but you cannot describe that password to anyone. It relies on your brains ability to recognise faces, and your brains inability to accurately describe the same faces.

Useless for the blind of course.

grrr. realuser

A technology called Pass Faces has been around for a few years. Microsoft simply substituted the faces for ink blots. Personally, I think it would be a lot easier to remember faces.

This'll never work with the "techie" crowd because they remember letters/numbers much better than they remember pictures. (ever wondered how unix fans can remember all of tar's options? :-)) On the other hand, for people who "think graphically" (designers, artists, etc), this may help. But I wouldn't bet on it, passwords are too deeply entrenched in our lives already -- ATM PINs, Phonebanking PINs, the whole nine yards.

And yes, I too don't see how this is different from Passface's Realuser, which uses faces in lieu of passphrases. I've tried Realuser, and I found it was far more difficult to remember their faces than it was to remember my passwords. And I could choose only 5 faces -- not too good, it's too easy for over-the-shoulder attacks, and it's a pain to change "faces" like I change passwords. I imagine a face-changing session would go this way: "Let's see, I chose a caucasian male last time, this time, I'll pick an asian female...". Uh huh, too much work.

Did everyone forget about this already?

Peace, Love, Linux

Check out this Slashdot story from last December, and the Real User site with "passfaces", which have been around for a long time.

The method has been previously described (using faces) by PassFace and RealUser, and they are trying to commercialize it.

You're probably thinking of real user

RealUser has done almost exactly the same thing, except using faces, not abstract designs. It's worth checking out their site, since they seem to have thought it through reasonably well. (Read the whitepapers; they have the real meat...) One of the interesting things about these systems is that since you can't describe your password, the correct choices have to be displayed on screen along with some invalid choices, which opens up the system to some attacks unless you construct it very carefully.

A year or so ago, I found this little beauty: PassFace Technology -- Give it a try. You click on people's faces to get in.

What was interesting was that in finding that URL, I went back to the site for the first time in over a year, and was able to log-in no problem. I remembered my combination of faces.

There's definitely something to this technology!

rOD.

I saw a new idea on passwording the other day, called passface. Realuser.com gives you a passface (five random pictures of UK college students) and you log in by chosing your passfaces in order out of a new 3x3 matrix of faces for each face.