Slashdot Mirror
Using a Password One Doesn't Consciously Remember
ZiggyM writes "Researchers from Hebrew University in Israel have devised a way to assign a password to a user in a way that prevents the user from conciously remember or describe it, yet the user can input it correctly over 90% of the time in a 3 month period after [s]he learns to input it.
It involves using visual recognition of previously-seen images, which you can recognize but cant consciously recall in detail. Recognizing the right ones from a series is interpreted as knowing the password, and the chances of guessing it is 1/100,000.
Not ready for practical use yet, but very interesting concept that can develop further."
My tinfoil hat protects me from the mind readers anyway!
At least it's a new use for my porn archive.
Do we get to use touch screens?
My password might be 5777364.
Read more about RoShamBo here
Hulk SMASH Celiac Disease
This is rather a stupid thing to study if you ask me, any password can be cracked, and the ironic thing is what if companies started doing this to their employees and when they leave they ask the employees what their password is? well they arent gonna know it and then the company will have to find another way to get the password.
Compare to a normal password-- 90% chance of successful identification? 100,000 possible combinations? Ick.
It better not be used in any situation where a machine can attempt the password, and hopefully they've avoided storing the password itself on the disk, though it certainly could be found with brute CPU (see above).
Basically, it looks like this is a very unimpressive system.
I use the same root password for all of my test boxes. It's 15 characters and made up of random letters and numbers. What is it? I have no idea :-)
I can type my password, but if you asked for it I couldn't tell you what it is. The other day someone needed my password for one of the test boxes. I had to open vi, type in the password, and read it back to them.
The only problem with this is that it takes so long to remember such a password, so as soon as you learn it you can't change it often.
There is no reasonable defense against an idiot with an agenda
:wq
When typing has gotten to the point of a reflex, you can just learn a pattern as opposed to a word to type. Often times I don't recall what my password is until I open a window where I can see the cleartext of what I'm typing.
I'm sure there are many variations on this possible. Probably by linking mnemonics and visual cues you could come up with a code-entry system that works reliably, yet makes it nearly impossible for someone to simply write down their code -- hence, easily steal. Use the brain for crypto.
The beauty of string passwords is that I can recall and input it within 3 seconds. It would become quite a hassle to take the time to go through a series of images everytime I wanted to sign into an account.
Still, it's an interesting concept, though I can't forsee it ever becoming applicable to personal computing.
Simple. Don't have the user click on an image, but track their iris to see which image they're looking at. Kills eavesdropping dead, and lets you reuse images too. Drives cost way up, but maybe it can come down with mass production? Just a thought.
My current 'standard' password is 10 characters, upper/lower cased with number/special characters. I have no clue what it is. Put me in front of a keyboard, I can type it out without fail each and every time.
It could be worse, it could be Monday.
It struck me yesterday that the answer to making secure and difficult to guess passwords that are immune to dictionary attacks is staring us all in the face. Let's recap:
A good password is:
Greater than 6 letters long
Composed of numbers and letters
Easy to remember, easy to reremember when changed.
.
Now it struck me that ideally we needed to create a new language that was innovative and imaginative which people could talk in, and use as passwords. Then it struck me: we already have it: L33T SPEEK
Passwords such as OMGN00BSUXSROR! and ROFLGH3YB0ISTFU and almost impossible to guess, are immune to dictionary attacks, and are perfectly memorable. Perhaps L33T language classes could be started at major institutions, and a Creative Commons licenced dictionary created.
It's about time someone started talking sense - password security is a problem which needs innovative solutions.
Meine Schwester ist sehr, sehr reizvoll - Nietzsche
Whats wrong with using the name of the month and sequential numbers up to the maximum 8 characters?
I cant really remember the PIN for my bank account, but when i'm standing in front of the cash automat i remember the moves i have to do with my fingers without problem. If i wanted to remember the PIN as a number i can close my eyes and pretend to type it though, so there is a way for me to know it consciously.
the most sexp i get is my paren-mode.
This should come in handy to all the other costumed crime fighters in the Slashdot community, too!
the best password is to have no password
along the same line.... what's the shortest distance between two points?
the shortest distance is to have NO distance at all. (Try the folding paper trick)
If you said a straight line, that'll do for now.
maybe someone could expand?
Keanu gets all the data locked in his head, and the password is a series of images...
"People" using "unnecessary" quotes should be "shot".
WHen we have DNA?
:)
Anyone last check their dna string...
I use a 9 letter password, it was 6 but some fuker saw it a few years back, now i type it so fast (plus fake key strokes).
Truth is, dont put anything behind a password which is THAT important. ANY password is crackable, what isn't tho is your imagination. We need mind readers so we can just "think" a image of our password
- http://www.milkme.co.uk
they should call it passphrase if you want people to use long passes
all the time websites/apps ask for a password it just re-enforces the insecurity of using a single word
8 character passwords/filenames should of died in the 70's
Yeesh, what a horribly written intro:
[...]to assign a password to a user in a way that prevents the user from conciously remember or describe it[...]
cant
Come on. The next sentence is really wretched. Not only is there a verb-subject agreement problem, is doesn't even parse:
Recognizing the right ones from a series is interpreted as knowing the password, and the chances of guessing it is 1/100,000.
Finally we have something which is not vulnerable to the rubber-hose cryptanalysis. Now the attackers can brute-force me as hard and as long as they want and I will not be able to tell them my password even if I want to! Now I feel totally safe, because even in the case of the most inhumane torturing, I will take my password to my grave. It's like using fingerprints in ATMs so the thief has to cut my finger off instead of taking my ATM card in order to steal my money, except for the lack of gelatin exploit. This is great news. I can stop recommending Password Safe to my users now.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
That said, I do end up memorizing most things this way--I know pin numbers, telephone numbers, and even my password by the "feel" of typing them, and I usually can't remember what they are when I'm not using a keyboard or number pad.
Orationem pulchram non habens, scribo ista linea in lingua Latina.
Would a screenshot then be enough to compromise your system? I recall reading a story on /. about monitors being viewed remotely somehow from like vans parked outside. Put the two together and I would be scared for my network. Another question would be why we haven't heard much in the last 2 years since Microsoft has been working on this same technology?
My bank-card pin-number uses a different trick. I just used four consecutive digits of pi. The trick is that they're pretty far into the sequence. Oh, and I made a mistake when I set it, so it's actually wrong. Oops. Guess it's pretty random, then. ;)
The only thing I have to remember is the password to get into Keypass and decrypt its database.
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
I use this a lot when im trying to navigate my way through a new 3d enviornment or backtrack to find an old website link. ;).
You simply go with your instinct, and more often than not it ends up being the path previously traveled. An interesting approach to idiot proof security
i know it says it's "not ready yet"
but even an 8 character, lower-case letter only password has 208827064576 possibilities...
it might take a while for that to catch up
My other sig is an import.
How long does it take a computer program to make 100,000 guesses? Not too long, I'd wager. I think the reason text passwords are so effective is that you can have different length passwords with uppercase, lowercase, numerical, and symbol characters, giving you some 100 characters to play with, in any combination, and in any length (within range), meaning that there are probably a lot more than 100,000 combinations.
If Hebrew University figures out a way to dramatically increase the number of possible combinations, while retaining one's ability to remember, but not describe, the password, that would be very useful in situations, for example, where your filesystem is encrypted with one of these passwords, and there is no way you can tell the CIA/FBI/NYPD/MPAA/RIAA/DEA/Microsoft/SEC what it is, in case one of these organizations seizes your equipment.
Passfaces uses a similar idea; you can remember the faces that make up your password, but you cannot describe that password to anyone. It relies on your brains ability to recognise faces, and your brains inability to accurately describe the same faces.
Useless for the blind of course.
ATH0 Bitcoin: 1DnwFLXczVZV8kLJbMYoheUrpqHesjxrSi
When you consider that the chance of randomly guessing a random 3-letter long case-sensitive password is 52^3 (1 in 140608), this really isn't that impressive.
...to counter this:p hp
http://www.brainwavescience.com/counterterrorism.
---
The World's Most Dangerous Password
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
As all sysadmins know well, the users do this all the time, i mean "use a password they can not remember later", and then ask the admin to recover their pretty password and you must explain "i only can give you a new password you could change later", and here again to begining, they change it and forget...
I suppose in the future, not far from now, we'll have to rely on other means of authentication anyway. Passwords are good, but people really don't like remembering them, let alone a few of them. And then there's the chaning of them every few weeks.
... we have most of the technology allready available in our homes. Just those touch screens and it should become the normal way to handle things ...
No I belive things like handscans via your touchscreen enabled display for one. So then there's always the risc of someone beeing able to forge your handprint, well add an iris check to that. with the webcam you allready have standard installed in your monitor (video conferencing should be also quite normal around that time). Need stronger authentication than that? Voice pattern recognition.
Seems like it's really far away
Comment removed based on user account deletion
This idea was shown in Johnny Mnemonic. When the 320 GB of data was shoved into Johnny's head, it was encrypted with three pictures. Those pictures needed to be reproduced in order to extract the data.
Colin Dean Go a year without DRM
Isn't this similar to how passwords were handled in Johnny Mnemonic? With the 3 random screen captures. I realize that this is different in that the user remembers which ones to pick, but isn't it the same principle?
Sci-Fi becomes reality once again.
3 months to get to 90%? Doesn't sound too good. And 1 in 100,000 means there are 100,000 possibilities, I guess, (RTFA? what's an A?) which really isn't that much to use brute force against (for a machine, anyway.) And, to put that in perspective, 4 letters (26^4) has over 450,000 combinations. So why not go with a 4-letter acronym and get >99% success immediately?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
... in a way that if you ask me for the correct sequence i can't really tell you for some weird reason i guess it's not my brains remembering the pass, it's my fingers :) I can type it while being shot at, in the middle of a fire or with FBI agents riding in but i cannot tell you the sequence even if you pull my nails off one by one.
It's that only with me?
CMU is working on Secure Human Authentication (HUMANOIDs) for quite sometime now.
Their scheme is also more difficult to guess since it suggests that the user should make
a random mistake to confuse the guessing adversary!!!
I use random patterns on the keyboard. I have to consciously remember the password for a little while, but, within a week or so, I no longer even remember what the password is. I just type it without thinking. I found out that I was doing something similar with my GPG key's passphrase. One day, I went to type it in and realized that I couldn't remember it despite the fact that I had just used it a few hours previously. It took me over a week to remember what my passphrase is. I was just about at the point of putting my revocation certificate into ciruclation and generating a new key.
Kind of reminds me of back when I still played the piano. Then, I would practice a piece so much that, after a while, I found it easiest to play with my eyes closed and let my mind just cruise along. The bad thing was, that if something startled or interupted me, I often couldn't remember where in the song I was.
Just pick a telephone number that you can remember well, but not your own. Practice typing it on the number pad a few times, until you get it through your subconcious and can type it w/o looking. Then select a random key on the keyboard as your starting point, and type in the phone number.
(i.g., 651-5984 = oiji09u ; [w/ oiu=456])
Secure, unquessable, and easy to remember.
I was thinking of converting to paganism, but where the hell can you find sacrificial virgins these days?
...this seems like a solution in search of a problem. Exactly what scenario requires a password that cannot be guessed by passers-by and cannot be extracted by interrogators but at the same time is unimportant enough that 90% accuracy is acceptable? Neat trick, but there are lots of things to work out before this is anywhere near practical.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
These kinds of passwords based on visual recall have been tried before. People have tried constructing scenes, using collections of natural photographs, and lots of other visual cues. All of them rely on the fact that "a picture is worth more than a thousand words", meaning that it would be hard for you to describe pictures in sufficient detail to disclose your password. There was a genuine bonanza of those kinds of attempts to make visual passwords in the late 1990's and some web sites tried using them, but they turned out not to be very useful in the end.
That is how I enter my bank card pin. I have no clue what it is, just my finger does the walking.
I prefer the "u" in honour as it seems to be missing these days.
Maybe this approach has its merits, but it would make entering passwords a bit complicated, strings are easier to handle.
I would find it much more important that knowledge about mnemonic techniques become more widespread. As far as I know, people who take part in memory contests, where they have to remember long numbers, use systems wehere each number stands for something (a letter in the alphabet, which in turn stands for certain words), and they quickly construct a kind of story around the numbers. Human beings are very bad at remembering raw data, but they are quite good at remembering semantically connected concept. As long as people conceive passwords as a kind of words, perhaps slightly altered and with numbers added, it will always be difficult - either it is still vulnerable (dictionary attacks or even if the word doesn't exist phonotactic attacks exploiting the rules sounds can combine in languages) or it is hard to remember, especially if the password has to change from time to time. It would be much easier of people conceived passwords as phrases or whole sentences and use the first, second, last or whatever letters that make up the words of these expressions (and still add numbers).
For instance, I think it would be relatively hard to remember a password like 'dl3w5pwthbtceth', but if it stands for 'During [the] last 3 weeks, 5 people went to [the] hairdresser because their cats eat their hair' (absurd, but not really devoid of semantic content and therefore possible to remember). Next time, the password might be '3ohtehfsocatioh2jgu' (3 of [the] hairdressers tried [to] extract [the] hair from [the] stomachs of [the] cats and to insert it on their heads, 2 just gave up). The style of the sentences that should not be too obvious can, of course, vary.
That is easier to remember than things conceived as nonsense-words and practically impossible to guess. The transition from one password to the next is easier - the next phrase or sentence can somehow be connected semantically or pragmatically to the previous in the mind of the owner of the password in a way that isn't accessible to anyone else.
With the ubiquity of passwords in today's everyday life, such methods deserve much more attention.
Everybody is saying that they can type their password although they don't remember it.
It reminds me of playing the piano. I can always remember the moves, but never the notes.
And worse, sometimes I need to have the score before me, even though I don't connect what's written with the actual notes on the keyboard.
Maybe we need a musical password...
how long until
"I like the idea of developing computer-human interfaces in which the computer is a skeptic [and so] doesn't perform the actions of which it is capable until the human has convinced it that the need is genuine and the human is an appropriate person for whom to perform this action," he said. "This might lead to greater safety for all of us."
Ouch! I don't like this idea at ALL. Anyone else disturbed?
Dave. Open the pod bay doors, please, Hal...Open the pod bay doors, please, Hal...Hullo, Hal, do you read me?...Hullo, Hal, do you read me?...Do you read me, Hal?...Do you read me, Hal?...Hullo, Hal, do you read me?...Hullo, Hal, do you read me?...Do you read me, Hal?
Hal. Affirmative, Dave, I read you.
Dave. Open the pod bay doors, Hal.
Hal. I'm sorry, Dave, I'm afraid I can't do that.
Dave. What's the problem?
Hal. I think you know what the problem is just as well as I do.
In some of the more oppressive legal environments, such as the United Kingdom, the police can demand that you hand over your passwords. Saying "I forgot", even if you did, is not considered a valid reason for not doing so. Check out the Regulation of Investigatory Powers Bill.
Using this technique, it would be possible to prove that you could not remember the password.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I memorized the layout of the keys in my bank PIN, and eventually forgot the numbers themselves.
This got me in trouble when I went to Japan, where the layout of the keys is reversed top to bottom from the banks in NYC.
I entered the code incorrectly three times (didn't realize why at the time), and got locked out of my account for 48 hours with no cash on me in Tokyo.
So, I would expect this could be a problem with even just slightly different keyboards.
Imagine introducing something like this and being responsible for it during the rollout period. You'd have to have people on-call 24/7 just to reset passwords, check IDs and help people log on to their computers (which is the very thing they need to do to even start their work day).
Additionally, you'd have to allow more attempts to enter a password correctly before locking the account or nobody would be able to log in (at least while people got used to the system). And thereby you'd actually weaken security significantly.
What if the password would be used to get cash from bank machines? In those cases the password is very short and it would be easy for a thief to get you to tell him the code in order to steal you money, or suppose you would be stupid enough to keep that code inside your wallet with the card.
This is a great idea IMO, a link between psychoanalysis and tech, really interesting!
But have they considered the possibility of someone cracking your password using telepathic ex-military dolphins?
Not only that, but they posted a story about a similar technology in 2001!
How about recursive Pig Latin? Every time you need to change it, just keep running it through your Pig Latin algorithm.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
An excellent strategy for getting around court ordering you to divulge a password without trying the "I forgot" excuse.
"You'd be surprised what someone can remember... if properly 'motivated'..."
Didn't Microsoft try something like this, with passwords? I'm trying to find the /. article on it, but I can't seem to find it. MS would develop a password that was developed from images the user saw, I can't remember the exact details (Damn, I need to find that article).
YOU'RE WINNER !
Another lame blog
Then he just showed up and pressed the enter key. I said you have a blank password!!!! He just laughed and said - It fooled you didn't it? how long were you trying?
From excellent karma to terible karma with a single +5 funny post...
Lots of people remember hundreds of phone numbers without any effort (I do). You dont have to make an effort to memorize them, after you use a number a few times you just know it. Lots of people know their social security, credit card numbers, etc. If I make a purchase online I by phone I never look at my credit cards , just say the numbers Remembering strings of numbers is much easier than memorizing other stuff, for example poems (remembering phone numbers is easy, remembering poetry is hard). Remembering passwords is the same, an alphanumeric string is easy to remember if it is not too long (say less than 15 characters). It you use a few passwords everyday after one week or so you just know them, dont have to write them down.
In some way, I think a lot of us may unconsciously be using this method already.
I once knew my 4-digit PIN for my creditcard by the pattern I would press on a keypad. At the time I wasn't consciously aware of the fact that I didn't know the actual sequence of numbers. One day I had to memorize the PIN for my Mom's creditcard (yeah, I know, the PIN is personal!) as I was to run an errand for her - just once. That was enough for me to forget my own PIN when I was to use my own creditcard the next time.
Today I memorize my PIN by reference, so I won't forget it. I believe this will serve me better in the long run, on so many different levels. If I was mugged back when I didn't consciously know my PIN, I'm sure the muggers wouldn't believe me (*). Also, we're getting new creditcard terminals in my country where the keypad layout is reversed.
(*) Take your pick: a reorganized face or an empty bank account.z
What would an EWOULDBLOCK block, if an EWOULDBLOCK could block would? -- me
What about using comic book sound effects, like "Schreeoownk" or "Ptoioioinnngg", kind of like the sounds Don Martin made up for his Mad magazine strips? Run them through a "l33t" translator, or just stick an "@" or "+" where you feel like it, and surely you'd have something that took a while to crack.
If nothing else, it'd make logging in a bit more fun...
By the taping of my glasses, something geeky this way passes
yikes, so trying this brute force would take about 1 second. cool.
Most comments complain that 1/100,000 is not secure blah blah blah. Use your imagination please, this is still in research, Im sure one could improve the system to make the odds harder. This is just an example of a new way to input passwords. And brute force does not necesarily help if you have a lockout policy, say lock the account for 1 hour after 3 failed password tries.
Also, remember that this scheme prevents the user from reusing the password somewhere else, writting it down or even giving it to someone for a bribe. It can have interesting uses.
I can see it now: Our newest greatest spy behind enmy lines must imput the code on the first try or the whole plan will be boched. Damn! 1/10 chance of missing it and of course he did! The free world is doomed!
Regarding the 90% rtention rate, that was within a 3-month period of having been issued the password. I'd say that at least for me, there's a far less than 90% chance that I'll remember a new password 3 months later if I don't use it regularly. So, this part of the new scheme doesn't seem so bad. Also, regarding the 1-in-100,000 chance of a false positive, consider that most bankcards are protected with a 4-digit numeric password, yielding only 10,000 combinations and they are considered secure for their inteded application. So, I guess my point is not every authentication scheme needs to meet the test of a Unix-like "one-way hash where you assume an intruder has access to the encrypted password." A scheme similar to what they've developed could very well be plenty acceptable in certain situations.
This reminds me of Japanese kanji - and anyone who's studied Japanese will know what I mean.
It's far easier to learn to read a word in kanji than to write it down accurately.
This sounds like a similar phenomenon.
If your comment title says 'Re: Foo', I'm not likely to read it.
Most systems already do this to prevent brute force attacks. Just lock the account after the third unsuccessful attempt. Now the user has to provide more data to prove they are who they are. In a secure environment, this may mean dna samples rather than just your pet's name.
That's a total misnomer if you're running windows. The Lan Manager hash isn't case sensitive and has a length limit. It's still stored by default in XP, 2000, etc. Once that's cracked (which would take a month at the longest on my Athlon xp2100+), the number of possible case-sensitive solutions takes a matter of seconds to run through.
Still, the issue is gaining access to the password hashes.
A few of my passwords are close to that. I use to learn my passwords by looking at them, and typing them out, without "reading" them to myself. Works great for remembering them, but the "downside" is that I have problems writing them down by hand or reading them out.
In fact I once spent the better part of an hour finding a public computer terminal (where are the bloody internet cafees when you need them?) so I could type the password out on a keyboard so I could tell it to a guy I worked with, because something had gone wrong while I was away on a course. In the end I still got it wrong because the keyboard had a layout I wasn't used to.
To psychologists who study memory, this sort of thing is not new. There have been some great experiments with word fragment completion: when someone is given a word, and then sees a fragment (i.e., defenestrate and _e_en_st_at_) they will be able to correctly fill in the fragment with that word even months later with no practice in between. Plus, this will occur even if they do not recall seeing the actual word.
Of course, words are susceptible to dictionary attacks. Images are one solution to that. Another would be motoric tasks. A certain series of mouse movements could be required as a password--this would be almost impossible to crack, and memory for this type of task, once learned, is very robust. Also, there really would be less reason to change this sort of password because it would be so inherently difficult to crack.
To those who say that it would be hard to consistently get very precise movements down, think about how precise you are when playing Unreal Tournament and aiming.
before the random images presented would imprint themselves onto the users' memory obfuscating the original password?
Microsoft Research released a whitepaper on using inkblots to this effect 2 years ago - In fact, the Win2k3 SDK supplies for prompting a user with a portfolio of database-sourced images when the user is challenged for their credentials so that third-parties can write plugins to do this.
1/100,000 ? HOW ABOUT 1 IN A MILLION?
Not even close
you need to have a password that can't be guessed as easily as 1 in 1x10^8
from a pretty decent short story. Pictures as passwords? Johnny Mnemonic anyone?
"Would you, could you, with a goat?" Dr Seuss
It's called a biometric.
http://www.cs.huji.ac.il/~kirk/Imprint_CHI04_final .pdf
I don't recall most of my passwords, anyway.
After about ten or twenty times, I just wind up entering them by muscle memory.
I can enter most of my passwords in under a second, without even looking at a keyboard.
Speaking of movie references, that gelatin exploit sounds like something out of the movie Gattaca. Except IIRC his defeated a pinprick blood checker as well.
I've been using the same password for everything for so long that I don't even remember what it is, I just type it in by muslce memory. ;)
This reminds me of the passkey system used in Johnny Mnemonic where a sequence of 3 random pictures unlocks the files.
Why not just train a chimpanzee to remember our passwords? Just carry them around, drop them in the "password monkey bucket", and then show them a series of pictures, followed by a keypad. I mean, it's been shown they can remember basic patterns and such, and it's not like they're going to give it up for anything stupid...like chocolate...
This won't work at all. If its based on images, every male password will be boobs.
I also use passwords that I do not consciously remember, but in a much less obscure manner.
Instead of basing a password on a word, I base passwords on keyboard finger patterns.
For example, one of my passwords might be "pqlsnv" or maybe "ju7ft6la"
Open notepad and type one of them out. Go on, try it.
Note the alternating finger pattern.
You can create very complex passwords with this method that are virtually impervious to dictionary based password crackers.
Definitely a novelty in having a password that my fingers know by heart but my mouth couldn't recite if my life depended on it.
- Cary
Fairfax Underground, where Fairfax County comes out to play
Sometimes I choose my password by making a shape on the keyboard. This works well with diagonal lines, since the keys on each row aren't lined up vertically with the keys below or above them. I tend to use this method most often for simple passwords, like pin codes. For example, let's say I decide on an "X" starting from the top left corner. That gives me 753951 using a keypad. Of course, I just remember the shape, not the numbers, which is handy for someone with a good visual memory, like me, since it's much harder to forget a simple shape, IMHO, than a string of numbers and/or letters.
;-) then can just reproduce your pattern and have your password. Of course, that's essentially a problem with any password that's based on characters. Another vulnerability, I would think, is that the characters are right next to each other. While not alphabetically close, these characters are close together, so a bruteforce attacker could easily narrow his search area by just knowing one of the keys. Using the spiral example, there are only four characters which could follow the leading 5: 4, r, t, 6.
Of course, there are drawbacks to this method. The first one is mentioned above. Another is you eventually learn the password by entering it a lot, unless you're conscientious at not looking at the keyboard. Of course, if you need to know the password, it's easy to retrieve it. Also, I doubt very complex shapes could consistently be entered reliably. For example, let's say I make a spiral starting at 5 (not on the keypad but on the key above r and t). This gives me 5rdcvgtf. But what if I forget that it curved left, not right, from r. Then I'd get 5rfvbhtg. Still a spiral and still starts from 5. Of course, I imagine it's also rather vulnerable to attack. If someone is watching you in the distance (or not so distance
Anyway, I find it's a good system for me.
OK...
.here's my password:
This works really well actually..
doggystylereversecowgirlmissionary
All one word...
It's easy to remember late at night by remembering the last 3 images I looked at.
I have a password i use that i can never say right with out me typing it or pretending to type it. Its a real B*tch when your fingers forget lol
Think of the number of sites and passwords you have. Now think of the number of traings you woul dhave to do, and the possibility of mental jumble increases rapidly. I'm sure people can remember the patterns much more easily since its the only such pattern they have associated to 'authentication' or 'weird scientific trial'. Try to keep the sequences straight once your mind groups everything into one 'authentication' or 'internet' bin and you have 20 passwords to remember. If authentication is so critical to justify a system such as this and the time expense of learning it, etc, I would suggest o go with two-factor authentication systems such as SecurID or similar systems.
-Andres.
It's ok as an add-on in addition to a password, for environments that can use it practically, since it balances out people's preferences for wimpy passwords, but it's not enough for most standalone use.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I have two passwords which I can't actually remember, however I can type them fast (if keyboard is standart).
It causes some trouble on laptops and such - I have to imagine typing slowly to remember sequence.
They are 13,15 symbols long, random letters/numbers/symbols.
...to keep Windows users from realizing they're seeing the blue-screen-of-death for the nth time. "I don't know what it is about Windows, but I can tell it when I see it."
Another way to remember yet not remember passwords is to have a word in mind, but shift your fingers one key to the left or right and type it out. I could figure out what my password actually is but I don't need to, and it will most likely never be in a dictionary.
Step 1: Give password prompt. Step 2: ??? Step 3: Log in. I suppose it will also inevitably lead to profit.
Don't even try to argue. It is NOT worth the while to go round the world to count the cats in Zanzibar.
how much are keycard and keycard readers (and a few keycard writers for the IT dept?
get yours in the morning using your simple ID card and give it in at night to prevent some smart arse taking it home, buying a writer and copying someone elses.
...I wouldn't want to try to sell it as an authentication mechanism to my executive masters.
Granted it does make it harder for the creds to be acquired via social engineering, but... there are easier ways to protect authentication credentials using existing methods, IMO.
For instance, what about the use of passphrases vs. passwords?
I.E. choose a sentence, including some punctuation, a lot harder to defeat with a basic dictionary attack, will likely take a lot longer for a brute force crack and users should (in theory) be able to remember a phrase like, say "Highlander 2 was utter crap!" much more easily than, say, xXzQwtY@#153.
Not as glamourous as the method descibed, but a much easier sell to users.
Combine with a physical token (RSA ID, smart card, whatever) and things get a little harder to break technologically.
Anyway, that's my $0.02.
Remember Johnny Mnemonic? That was how they encrypted or locked the content in his brain....
You're messin' with my Zen Thing, man.....
http://fuckedcompany.com/ That's where you belong, heh.... what did you develop, an image viewer program that reads 3 digits?
... is post on slashdot telling how I select my password(s) ... Sheesh, I can't believe what I'm reading here, of all places.
Tag lost or not installed.
Didn't they do this in the movie version of Johnny Mnemonic?
He picked three images at random for a passcode which he would then not conciously know. Of course in the original short story, it was a spoken phrase...
Actually, a lot of my passwords I can't consciously recall. I use finger "gestures"/patterns for my passwords. I know the starting position of my hand, and then I just make the proper finger movements and my passwords is typed in. Change the position on the keyboard, keep the movements the same, and you've got a whole new password.
My work phone number is something I only know by dialing it. If I need to give it out, I have to simulate dialing it to get the digits.
Also, my home computer password is a set of randomly generated and capitalized alphanumerics. How I remember it is similar, except I know most of it by heart now but if I think about it while entering it I usually get it wrong.
But the pictures are a neat idea.
i read the post, and i knew it reminded me of something
Did the tool judge your password before or after you blurted it out on /. ;)
Not the "same password for everything" part, but the type without thinking part. I currently will type a password depending on the login screen I'm shown. For example on the mud I play, I'll type type in the correct sequence without even thinking about it. I also do the same for my university account. I remember both with the username and password both being very different due to the fact the login screens look different.
You don't need to type in the same password for everything, you just need different login screens (although if you have 15 boxes of the same thing, not easy).
Yes, most people won't be able to remember these visual images in detail, but that doesn't apply to that minuscule number of people who have eidetic memories. What do we do about them?
On vit, on code et puis on meurt.
While 1 in 100,000 chances of guessing seem like really bad odds: "OMG..we can brute force this, lolz!". In reality, this is a probably much stronger form of protection than it first sounds. The article stated that the images to be recognixed came from a library of over 200,000. This means that at each login attempt, you could have a different group of images come up that would still contain a legitimate password for the user to type in. Even if each attempt had a 1 in 100,000 chance of being guessed, 2 guesses wouldn't give you a 2 in 100,000 chance of being right and so on... ...But then I suppose you could just look for which pictures are common in each password attempt, and get in that way...Shit, I'll shut up now.
I have been thinking about the password problem for some time and i finally found a universally secure yet recallable method. I take 4 characters, any random 4 and use these always, say for example: erfg then think of a song that you know the lyrics to, like the chorus to "give peace a chance", all we are saying is give peace a chance. The first letter of each word is: awasigpac so i make my password: erfg&awasigpac if the password only allows 10 or 8 characters, then the password will only be the 1st 10 or 8 letters of the long password. And then when ever i need to change my password, i just think of another song, and then thats all i have to remember, the song's chorus. so summer breeze is my new song, my password is: erfg^sbmmffbttjimm the password can seem long, but its recallable and totally hard to remember in its given form. So obviously this works for quotes or sayings or any other memorable sayings.
Another use for the human facility of "nemory": when something never happened, and you don't remember it. A nemorized password can not be extracted from a person, nor can the infosystem be analyzed in any way, even through complete physical access, to determine it. Roughly analogous to "dark matter" and "dark energy", nemories are our experience of "dark info", estimated as the overwhelming majority of information in the Universe. Nemory devices and techniques will revolutionize the Info Age, without anyone even noticing, or even happening at all.
--
make install -not war