Slashdot Mirror
Authenticating With Your Mouse?
degauss asks: "I am looking into various authentication schemes form my home machine, and one that I thought would be interesting would to be having a dummy login screen up with a user/pass prompt, but instead of entering a user/pass, you click at certain points on the screen in certain rytmhmic patterns (all of this is of course unknown to any unauthorized users, who will pound at the password for years). I was wondering if there it any such software or interface currently being developed, as it provides an interesting [semi-]biometric security solution without dumping a ton of cash on new hardware."
tinfoil hat linux does this, to some degree. IIRC, The login screen is called "arcade mode" for good reason.
Keep your packets off my GNU/Girlfriend!
I don't know if this would work. I guess it would really give you less variation in possible passphrases than a normal password.
Maybe if you were to 'draw' the password on the screen and the computer would both use the password and analyze the writing it could give you an extra level of security. That would probably work better with a stylus or a touch screen than with a mouse, though.
As for hoping for people to try to type in passwords instead of using the mouse, that is only security by obscurity. Don't trust that.
How about using both of these ideas together? Have it to where even the correct username/password is not accepted unless the user clicks on the right section of the screen, or right sequence of sections of the screen in place of simply clicking "Ok"!? So in essence the "Ok" button would be a dummy and the correct "button" would be another portion of the screen entirely?
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
This would certainly foil those hardware keylogger devices that nip between your keyboard and computer to grab passwords and the like. As far as I know, nothing comparable has been done for the mouse as the relative movements of the mouse aren't particularly useful, both because they don't always map to the relative position of the mouse, and because you don't know what the user is clicking on without a screen grab too.
Hmm, now that could be useful - a program that sits in the background doing a screen grab everytime the user clicks the mouse. Saves having to capture every change in the screen to figure out what they are doing with the mouse.
Shouldnt there be accessibility functions with an onscreen keyboard? use that and your keystrokes wont be seen atleast via the keyboard...
Leave *my* mouse out of this!
Here before all but 8486 of you.
you better make sure that *even if people know* that you use the mouse to enter your pass-gestures, it's still secure. don't count on the mouse thing being a secret.
How about logging in by executing some steps on your Dance Dance Revolution pad?
Opinions on the Twiddler2 hand-held keyboard?
Damn.
:)
..
Try to explain to a system admin that the reason you have lots of intruder lockouts is because your mouseball was dirty
It could double as a "Is this employee drunk?" test
No offense, but that's a stupid idea. You can't remotely log in, nor could you give the password to someone else if you wanted or needed to.
No security scheme ever ensures 100% security. EVER - they just make it more likely for the intruders to give up. If someone really wants to get into your machine, they'll disassemble it and copy the hard drive sector-by-sector using another machine, then examine it there, completely bypassing any "sekret kode" that you made.
The only secure computer is one that contains worthless information, is turned off and disconnected from the outside, wired with a hair-trigger self-destruct mechanism, hidden near some more flashy and important-looking decoys, buried miles underground in a secure vault which is patrolled by extremely well compensated, disiplined and obedient guards who are very heavily armed.
Ie: no system in the world is secure. Not even yours. To make something as "u17A-sekure" and 'leet as a mouse password entry system is, quite frankly - dumb for the purposes of anything but entertainment or looking naively "cool" in the movies.
My advice: Audit your computer, closing any remote ports and shutting down unnecessary services. Apply latest patches and updates to your computer. Use a 'strong' password (ie: not something obvious) that you change frequently and don't write down. Don't leave yourself logged in and walk off, remember to lock your doors, but don't leave the key lying around - and you'll be fine.
I did something similiar (in terms of security) when I was developing a client/server app. What I did was trap for the backspace key after entering the first and last letter of a password, for instance if your password was "monkeyfeces", you would have to type "m(backspace)monkeyfeces(backspace)s". That way, if someone knew your password, watched you type it in or even had some rouge program monitoring your keystrokes they would still have a tough time figuring out why your password doesn't work. I am not saying this is foolproof but it's better than the man with the rubber glove who isn't suprisingly gentle.
IIRC there was a Slashdot article (or a quickie) not long ago related to this. I think the password was actually a sequence of symbols which appeared on the screen and they had to be clicked on in the proper order and the order that they appeared in a grid with other abstract symbols would change at each login. Hope I explained that right.
I have also heard about a bio auth method that takes into account your typing rythym. As a simple example, if you type your password in to the beat of 'Shave and a haircut... two bits' it would only accept that valid password if it were typed with this rythym.
But since the timer resolution on a computer is so small it can detect minute differences between you and an imposter. A neural network can be trained to learn your pattern of typing. Each successful login becomes a sample in its training set. That way it learns your natural variations and you don't have to perform perfectly each time or risk being rejected. Again no expensive biometric hardware required.
Degauss:
:-) Just kidding.
Here is my thinking. This is your HOME machine. But you make it sound like this will be in a place where it will be exposed to a lot of people who have no business using it, or are desperate to break in.
I mean, are your siblings or spouse wanting to use your PC that badly? Are they after your porn stash?
Or is your password that easily guessable... that is something you can fix without resorting to clever software that only belabors the authentication via obfuscation.
Even if it wasn't under attack, obfuscating the login screen is not really a good idea. All the malicious user would need to do to discover the secret is casually observe a legitimate user bypassing said fake login screen.
Moreover, your login program should not allow someone to sit at the computer all day and attempt passwords. It should lock unprivledged accounts out after a few wrong tries ( 5, preferably 3). If it does unlock itself, the cool off period should be at least an hour. Also, each attempt should take progressively longer to check after each failure. This is especially important for Administrator / root accounts which should not lock themselves out.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
First, there is the question of how many clickable subdivisions that you divide the screen in. Second, it will take a lot longer, especially as the subdivisions get smaller, as it will require more precise mousing.
I think Gesture recognition would be a better method, personally.
This
I saw a movie where the authentication was done via a puzzle. Creating a drawing would be a great way to authenticate for some people (obviously not for the blind!). It would also be a terror for public terminals in which left-handed people most use (such as myself).
:)
The question isn't how the interface would be, but rather how to impliment it
What about nice simple mouse fingerprinting devices on mice?
Oh well, that has been discussed on so many movies that will make people scared:
We all know someone can cut our finger to get the fingerprint..
yeah, I know, grouse.
let's wait for dna authentication..
but again, anyone can get samples from us and use it..
hmm..
let's stick with passwords for some time ok?
Something I've wanted to do for a while is get one of those keychain USB drives, and keep my private key on it, and perhaps also a symmetric key. Then I can run a crypto filesystem (not for everything, just for the stuff I want to keep private) and unplug the key when I'm away from the computer.
.. !
Hey wait, this sounds like something I read earlier today
There probably isn't more than 128M of stuff I really need to keep private, so it might make just as much sense to keep all the files on the USB drive too.
455fe10422ca29c4933f95052b792ab2
This would be great on Tablet PC's. I've got one, and have had a tough time securing the thing because of this very issue.
Anyone got some links for Windows?
If it isn't you sitting at the computer, the computer says, do you want to leave a message for the owner of the computer, and allows you to type a message in
I have mod points and I am not afraid to use them
Many years ago, I needed to secure my work PC (a spanking-new IBM XT-286) from the night shift; since I was doing CAD I had an EGA and a fast machine so my office became the midnight game room.
:-) COM2 had a plotter attached & I would turn the plotter on and off appropriately to boot the system. I never booted when there was somebody else in the room.
I wrote a routine which put a login prompt on the screen, and then waited for a particular cadence on the DTR line of COM2. I patched this code into some blank space on the EGA's BIOS extension ROM, and executed it before the keyboard was even enabled during POST
Then came a change in company ownership, with its attendant politics... I was canned on a Friday afternoon with no notice whatsoever. Nobody asked about my password. Of course the vultures descended on my office, and among the first things to go was the plotter. No plotter, no password.
Apparently after several frustrating weeks in Software Engineering the PC was returned to IBM for an expensive "repair" -- if someone had asked I'd have told them to swap the original EGA ROM from my desk drawer back into the EGA. Nobody asked.
Try this for a mouse you can authenticate with. Not sure if there are Linnu drivers for the fingerprint stuff though
The Romans didn't find algebra very challenging, because X was always 10
How about something that works similar to a bank machines pin number? This might seem a bit too simplistic but here goes:
Assume that your screen or dialog box is divided into three imaginary columns, and rows. Now look down at your number pad (see figure1)
figure 1|X|X|X| |7|8|9|
|X|X|X| |4|5|6|
|X|X|X| |1|2|3|
When the login in prompt is displayed start tracking the mouse position and click events.
- If the user clicks in the top left third of the screen then record that as a 7,
- if the mouse is in the middle row centre column record a 5,
- if the mouse is in the bottom third, middle column then record a 2. .
.
(see figure2)|X|X|X| |7|8|9|
|X|X|X| |4|5|6|
|X|X|X| |1|2|3|
Finally use a double-click to stop recording numbers and start the authentication.
Sure it's a nice idea, but what happens when you need to authenticate with someone else standing behind you?
They will be immediately be able to see where you clicked on the screen. Hiding the cursor as the clicking is done won't do any good either as you won't know where you are clicking!
This is why passwords are blanked out when you enter them, so somebody watching the screen won't find your password out.
You think that having unauthorised people "pounding at the password for years" when you aren't accepting passwords does anything to aid security? They'll do that anyway. It doesn't matter if you accept passwords or not, the chances of somebody guessing correctly is infintessimaly small.
I've always thought that it would be interesting to watch the way that someone types in the password as well as what they type in. If your cadence isn't within your normal parameters, then you don't get in even if you have the right password.
It would have to be auto adjusting, or subtle changes in they way you type in general could throw it off, and heaven help you if you break your hand, but an interesting idea anyway.
There are other reasons why it would be problematic as well. You'd probably bet out of luck if you needed to log in on a keyboard that was different in some substantial way from your own.
Anyone know if anything like this has been done?
A graphical login screen where you have to choose pictures in the right order sounds like a good idea, and I think I've just though of an improvement. Make them selectable with the mouse wheel without giving any feedback.
The reason is simple, the buttons make an obvious sound, but the wheel should not. It could give some extra security.
As long ago as WW2, it was realised that different people had distinctly different "styles" of keying. If you had a sample of a person's Morse code, for example drawn on paper tape, you could compare an unknown sample to see if they were sent by the same person. This turned out to be a very accurate "fingerprint".
Now, I'm not saying you should enter your password by Morse code on the mouse button, but something that reads the rhythm of mouse clicks or keypresses would work.
The most useful usage of such authentication schemes is for authenticatino on a PDA such as a Palm.
I know that some application are available for PalmOS that use this things, however I don't remember the names.