Authenticating With Your Mouse?

degauss asks: "I am looking into various authentication schemes form my home machine, and one that I thought would be interesting would to be having a dummy login screen up with a user/pass prompt, but instead of entering a user/pass, you click at certain points on the screen in certain rytmhmic patterns (all of this is of course unknown to any unauthorized users, who will pound at the password for years). I was wondering if there it any such software or interface currently being developed, as it provides an interesting [semi-]biometric security solution without dumping a ton of cash on new hardware."

Comments

tinfoil hat

[Hubert_Shrump]

tinfoil hat linux does this, to some degree. IIRC, The login screen is called "arcade mode" for good reason.

Don't count on obscurity

[bkhl]

I don't know if this would work. I guess it would really give you less variation in possible passphrases than a normal password.

Maybe if you were to 'draw' the password on the screen and the computer would both use the password and analyze the writing it could give you an extra level of security. That would probably work better with a stylus or a touch screen than with a mouse, though.

As for hoping for people to try to type in passwords instead of using the mouse, that is only security by obscurity. Don't trust that.

Re:Don't count on obscurity

[ShmuelP]

As for hoping for people to try to type in passwords instead of using the mouse, that is only security by obscurity. Don't trust that.

By the way, relying on people to not type in your password is security through obscurity. Don't trust that. :-P

Seriously though, if you are going to use clicking as a password, you need to treat it the same way. Since anyone who watches you could easily see where the mouse is moving, this would be similar to letting other people watching the keyboard as you slowly typed your password: not a good idea. Even worse, a tempest-like system would allow someone to watch your "password", without your even seeing a person there!

Instead, I would suggest drawing as an extra layer of security before the password. Meaning, you have to draw the "password" before typing the real password. If you don't draw the correct "password" first, then even the real password isn't accepted.

Along the same lines...

[thecampbeln]

How about using both of these ideas together? Have it to where even the correct username/password is not accepted unless the user clicks on the right section of the screen, or right sequence of sections of the screen in place of simply clicking "Ok"!? So in essence the "Ok" button would be a dummy and the correct "button" would be another portion of the screen entirely?

Re:Along the same lines...

[Motherfucking Shit]

So in essence the "Ok" button would be a dummy and the correct "button" would be another portion of the screen entirely?

Good idea. I propose that we give the real button the appearance of the Pi symbol, and place it in the far lower right-hand corner of the screen... ;)

How about....

[orthogonal]

How about logging in by executing some steps on your Dance Dance Revolution pad?

Re:drawing and puzzles

[bpb213]

"Creating a drawing would be a great way to authenticate for some people"

Want to take a bet on how many stick people you get as passwords? :)

Non-typing passwords...

[Crash Gordon]

Many years ago, I needed to secure my work PC (a spanking-new IBM XT-286) from the night shift; since I was doing CAD I had an EGA and a fast machine so my office became the midnight game room.

I wrote a routine which put a login prompt on the screen, and then waited for a particular cadence on the DTR line of COM2. I patched this code into some blank space on the EGA's BIOS extension ROM, and executed it before the keyboard was even enabled during POST :-) COM2 had a plotter attached & I would turn the plotter on and off appropriately to boot the system. I never booted when there was somebody else in the room.

Then came a change in company ownership, with its attendant politics... I was canned on a Friday afternoon with no notice whatsoever. Nobody asked about my password. Of course the vultures descended on my office, and among the first things to go was the plotter. No plotter, no password.

Apparently after several frustrating weeks in Software Engineering the PC was returned to IBM for an expensive "repair" -- if someone had asked I'd have told them to swap the original EGA ROM from my desk drawer back into the EGA. Nobody asked.

Re:Non-typing passwords...

[karnal]

Sort of offtopic:

I was perusing various car sites a while ago, looking for fix-it information on my car. I found an interesting thing that someone had done for a kill switch: they integrated a push of the passenger's window "up" button (on the driver's side only) to allow the passlock 2 (GM) signal to the ECM.

Kind of a neat hack, seeing as if you didn't tell anyone, and no one paid close attention as you started the car, they probably wouldn't pick up on the trick. However, one of the dumber things you can do in that situation is post it on the internet for all to see..... Guess that's why you didn't announce your "lock out" until well after you were finished with that type of security.

Kudos as well to you, though -- that was a neat trick. Almost makes me wish I was more into hardware (like I was as a teenager)....