Slashdot Mirror
Using a Password One Doesn't Consciously Remember
ZiggyM writes "Researchers from Hebrew University in Israel have devised a way to assign a password to a user in a way that prevents the user from conciously remember or describe it, yet the user can input it correctly over 90% of the time in a 3 month period after [s]he learns to input it.
It involves using visual recognition of previously-seen images, which you can recognize but cant consciously recall in detail. Recognizing the right ones from a series is interpreted as knowing the password, and the chances of guessing it is 1/100,000.
Not ready for practical use yet, but very interesting concept that can develop further."
I use the same root password for all of my test boxes. It's 15 characters and made up of random letters and numbers. What is it? I have no idea :-)
I can type my password, but if you asked for it I couldn't tell you what it is. The other day someone needed my password for one of the test boxes. I had to open vi, type in the password, and read it back to them.
The only problem with this is that it takes so long to remember such a password, so as soon as you learn it you can't change it often.
There is no reasonable defense against an idiot with an agenda
:wq
When typing has gotten to the point of a reflex, you can just learn a pattern as opposed to a word to type. Often times I don't recall what my password is until I open a window where I can see the cleartext of what I'm typing.
Yup. That's not secure in the least. 100,000 possible combinations is equivalent to having a password of only lowercase letters, exactly four letters in length, where the first letter has to be from "a" through "f" (6 * 26 * 26 * 26 = 105,456).
Definitely one of the worst password-type mechanisms proposed in recent history.
they should call it passphrase if you want people to use long passes
all the time websites/apps ask for a password it just re-enforces the insecurity of using a single word
8 character passwords/filenames should of died in the 70's
That said, I do end up memorizing most things this way--I know pin numbers, telephone numbers, and even my password by the "feel" of typing them, and I usually can't remember what they are when I'm not using a keyboard or number pad.
Orationem pulchram non habens, scribo ista linea in lingua Latina.
How long does it take a computer program to make 100,000 guesses? Not too long, I'd wager. I think the reason text passwords are so effective is that you can have different length passwords with uppercase, lowercase, numerical, and symbol characters, giving you some 100 characters to play with, in any combination, and in any length (within range), meaning that there are probably a lot more than 100,000 combinations.
If Hebrew University figures out a way to dramatically increase the number of possible combinations, while retaining one's ability to remember, but not describe, the password, that would be very useful in situations, for example, where your filesystem is encrypted with one of these passwords, and there is no way you can tell the CIA/FBI/NYPD/MPAA/RIAA/DEA/Microsoft/SEC what it is, in case one of these organizations seizes your equipment.
When you consider that the chance of randomly guessing a random 3-letter long case-sensitive password is 52^3 (1 in 140608), this really isn't that impressive.
There is an easy solution to that. Don't ask them to make a password. Give them one of a appropriate security (random sylabols or random passphrases work well), and don't change it for 6 months to a year. This has worked fine in all the work environments that I have been in. If people still have problems remembering their password you should revaluate wheter you are giving them the best possible length password. But humans are horrible random number generators, so don't base you security on expecting them to create secure passwords. I wouldn't trust myself to create a secure password without a good random method.
:)
Oh and I would lie to some for chocolate as well
...this seems like a solution in search of a problem. Exactly what scenario requires a password that cannot be guessed by passers-by and cannot be extracted by interrogators but at the same time is unimportant enough that 90% accuracy is acceptable? Neat trick, but there are lots of things to work out before this is anywhere near practical.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Maybe this approach has its merits, but it would make entering passwords a bit complicated, strings are easier to handle.
I would find it much more important that knowledge about mnemonic techniques become more widespread. As far as I know, people who take part in memory contests, where they have to remember long numbers, use systems wehere each number stands for something (a letter in the alphabet, which in turn stands for certain words), and they quickly construct a kind of story around the numbers. Human beings are very bad at remembering raw data, but they are quite good at remembering semantically connected concept. As long as people conceive passwords as a kind of words, perhaps slightly altered and with numbers added, it will always be difficult - either it is still vulnerable (dictionary attacks or even if the word doesn't exist phonotactic attacks exploiting the rules sounds can combine in languages) or it is hard to remember, especially if the password has to change from time to time. It would be much easier of people conceived passwords as phrases or whole sentences and use the first, second, last or whatever letters that make up the words of these expressions (and still add numbers).
For instance, I think it would be relatively hard to remember a password like 'dl3w5pwthbtceth', but if it stands for 'During [the] last 3 weeks, 5 people went to [the] hairdresser because their cats eat their hair' (absurd, but not really devoid of semantic content and therefore possible to remember). Next time, the password might be '3ohtehfsocatioh2jgu' (3 of [the] hairdressers tried [to] extract [the] hair from [the] stomachs of [the] cats and to insert it on their heads, 2 just gave up). The style of the sentences that should not be too obvious can, of course, vary.
That is easier to remember than things conceived as nonsense-words and practically impossible to guess. The transition from one password to the next is easier - the next phrase or sentence can somehow be connected semantically or pragmatically to the previous in the mind of the owner of the password in a way that isn't accessible to anyone else.
With the ubiquity of passwords in today's everyday life, such methods deserve much more attention.
"I like the idea of developing computer-human interfaces in which the computer is a skeptic [and so] doesn't perform the actions of which it is capable until the human has convinced it that the need is genuine and the human is an appropriate person for whom to perform this action," he said. "This might lead to greater safety for all of us."
Ouch! I don't like this idea at ALL. Anyone else disturbed?
Dave. Open the pod bay doors, please, Hal...Open the pod bay doors, please, Hal...Hullo, Hal, do you read me?...Hullo, Hal, do you read me?...Do you read me, Hal?...Do you read me, Hal?...Hullo, Hal, do you read me?...Hullo, Hal, do you read me?...Do you read me, Hal?
Hal. Affirmative, Dave, I read you.
Dave. Open the pod bay doors, Hal.
Hal. I'm sorry, Dave, I'm afraid I can't do that.
Dave. What's the problem?
Hal. I think you know what the problem is just as well as I do.
I memorized the layout of the keys in my bank PIN, and eventually forgot the numbers themselves.
This got me in trouble when I went to Japan, where the layout of the keys is reversed top to bottom from the banks in NYC.
I entered the code incorrectly three times (didn't realize why at the time), and got locked out of my account for 48 hours with no cash on me in Tokyo.
So, I would expect this could be a problem with even just slightly different keyboards.
Didn't Microsoft try something like this, with passwords? I'm trying to find the /. article on it, but I can't seem to find it. MS would develop a password that was developed from images the user saw, I can't remember the exact details (Damn, I need to find that article).
YOU'RE WINNER !
Another lame blog
This reminds me of Japanese kanji - and anyone who's studied Japanese will know what I mean.
It's far easier to learn to read a word in kanji than to write it down accurately.
This sounds like a similar phenomenon.
If your comment title says 'Re: Foo', I'm not likely to read it.