Using a Password One Doesn't Consciously Remember

ZiggyM writes "Researchers from Hebrew University in Israel have devised a way to assign a password to a user in a way that prevents the user from conciously remember or describe it, yet the user can input it correctly over 90% of the time in a 3 month period after [s]he learns to input it. It involves using visual recognition of previously-seen images, which you can recognize but cant consciously recall in detail. Recognizing the right ones from a series is interpreted as knowing the password, and the chances of guessing it is 1/100,000. Not ready for practical use yet, but very interesting concept that can develop further."

Comments

My tinfoil hat

[Zegnar]

My tinfoil hat protects me from the mind readers anyway!

Re:My tinfoil hat

[Baron Eekman]

How's this going to help?

I'm not remebering my passwords all the time already

Well

[Anonymous Coward]

At least it's a new use for my porn archive.

Do we get to use touch screens?

Their own metrics are so awful.

[mlyle]

Compare to a normal password-- 90% chance of successful identification? 100,000 possible combinations? Ick.

It better not be used in any situation where a machine can attempt the password, and hopefully they've avoided storing the password itself on the disk, though it certainly could be found with brute CPU (see above).

Basically, it looks like this is a very unimpressive system.

Re:Their own metrics are so awful.

[Anonymous Coward]

Yup. That's not secure in the least. 100,000 possible combinations is equivalent to having a password of only lowercase letters, exactly four letters in length, where the first letter has to be from "a" through "f" (6 * 26 * 26 * 26 = 105,456).

Definitely one of the worst password-type mechanisms proposed in recent history.

Re:Their own metrics are so awful.

[Oculus Habent]

in reality a truely random four-letter password is probably more secure than most people's password. Have you forgotten they'll likely Give it up for chocolate, anyway? If they don't really know it, they can't write it down and can't divulge it.

The specific implementation may need work, but the concept has very real possibility.

Best comment when I told someone their password expires every 90 days and they can't use the last two:

"That's OK, I have four grandchildren."

Re:Their own metrics are so awful.

[pavon]

For reference an eight character password consisting of random upper-case, lower-case and numbers has about 200,000,000,000,000 combinations. A twelve character pronouncable password is about the same, and is what I use for all of my "important" passwords with about a 20% chance of typos. If one were to pick a random english word out of /usr/share/dict/words, that password would be twice as secure as this method, and we know easy a dictionary attach is.

Re:Their own metrics are so awful.

[pavon]

There is an easy solution to that. Don't ask them to make a password. Give them one of a appropriate security (random sylabols or random passphrases work well), and don't change it for 6 months to a year. This has worked fine in all the work environments that I have been in. If people still have problems remembering their password you should revaluate wheter you are giving them the best possible length password. But humans are horrible random number generators, so don't base you security on expecting them to create secure passwords. I wouldn't trust myself to create a secure password without a good random method.

Oh and I would lie to some for chocolate as well :)

I do this now

[Lxy]

I use the same root password for all of my test boxes. It's 15 characters and made up of random letters and numbers. What is it? I have no idea :-)

I can type my password, but if you asked for it I couldn't tell you what it is. The other day someone needed my password for one of the test boxes. I had to open vi, type in the password, and read it back to them.

The only problem with this is that it takes so long to remember such a password, so as soon as you learn it you can't change it often.

Re:I do this now

[Wordsmith]

Don't worry. I've got your mother's phone number right here ...

Re:I do this now

[Entropy Unleashed]

Why not just use some primitive "keyboard art"? The main alphanumeric area can be considered a 4 by 10 area of pixels, with a possible 3 colors(normal, not typed, and with Shift key). This would offer the possibility of easy visual recognition/reconstruction with ~10^19 possible combinations. For example, we could use a drawing of a TIE Bomber as a password.

......0...0......
.....0__0__0.....
......0...0......

would become ridFGhIJkcm, which is judged to be a rather strong password by http://www.securitystats.com/tools/password.php .

Re:I do this now

[Anonymous Coward]

the only thing worse than using the same root password for all of your boxes is telling everyone that.

i currently remember 24 16-random-character passwords which i generate by locking myself in the closet with a torch, pad, pencil and 3 dice. for each character of the password, i roll each die once and concatenate the 3 individual numbers to give me one of 216 codes which i map to the numbers 0 through 215. i then divide this number by 72 and take the remainder as an index into my character table. the table contains uppercase, lowercase, numerals, and shift+numerals, which of course adds up to 72 characters. i sometimes replace some of the characters at random with characters outside the set (plus, brace, comma, etc) when i am feeling paranoid. i repeat this process until i have my 16-character password, writing each character on my pad as i go. i then study the written password until i feel i have remembered it. then i immediately tear the paper up take it into the bathroom and burn it in the toilet. i throw the rest of the pad in the fire incase someone tries to get the imprints, and usually i break the pencil in half and throw it in too. then if i need to go to the toilet, i'll go before i flush everything down. it sometimes takes a while for the pencil to burn. i then wash my hands thoroughly, twice, and turn the light switch on and off 5 times before i leave the room. i then go and unplug my machine from the network, take it into the closet, boot single-user mode and change my password.

Re:I do this now

[Matt]

I've always had the same "problem" with passwords and phone numbers. I can't remember my mother's phone number, but sit me down at a phone and I'll dial her up without thinking about it.

I'm much the same. I think I "remember" phone numbers primarily by the pattern formed by entering the sequence on a keypad.

To quote a phone number I almost have to watch myself dial it. Even worse is remembering my own phone number. I don't exactly call it often.

Very interesting

[bigberk]

I'm sure there are many variations on this possible. Probably by linking mnemonics and visual cues you could come up with a code-entry system that works reliably, yet makes it nearly impossible for someone to simply write down their code -- hence, easily steal. Use the brain for crypto.

Time?

[blike]

The beauty of string passwords is that I can recall and input it within 3 seconds. It would become quite a hassle to take the time to go through a series of images everytime I wanted to sign into an account.

Still, it's an interesting concept, though I can't forsee it ever becoming applicable to personal computing.

To prevent eavesdropping, use iris tracking

[arvindn]

Simple. Don't have the user click on an image, but track their iris to see which image they're looking at. Kills eavesdropping dead, and lets you reuse images too. Drives cost way up, but maybe it can come down with mass production? Just a thought.

This is too complicated - try this

[SimianOverlord]

It struck me yesterday that the answer to making secure and difficult to guess passwords that are immune to dictionary attacks is staring us all in the face. Let's recap:

A good password is:

Greater than 6 letters long

Composed of numbers and letters

Easy to remember, easy to reremember when changed.

Now it struck me that ideally we needed to create a new language that was innovative and imaginative which people could talk in, and use as passwords. Then it struck me: we already have it: L33T SPEEK .

Passwords such as OMGN00BSUXSROR! and ROFLGH3YB0ISTFU and almost impossible to guess, are immune to dictionary attacks, and are perfectly memorable. Perhaps L33T language classes could be started at major institutions, and a Creative Commons licenced dictionary created.

It's about time someone started talking sense - password security is a problem which needs innovative solutions.

Re:This is too complicated - try this

[ffsnjb]

are immune to dictionary attacks,...and a Creative Commons licenced dictionary created.

Uh, heh. Yeah, that's it! :)

Re:This is too complicated - try this

[abscondment]

A good password is:

• Greater than 6 letters long
• Composed of numbers and letters
• Easy to remember, easy to reremember when changed.

I don't think so. On a single machine it takes l0phtcrack a day or two to crack passwords with only letters and numbers.

It took my comp 36 days to crack the M$ generated ASPNET user account; it's generated from the full keyboard charset.

Password policies like this won't enhance security. Maybe disabling LM hashes would, but the vulnerability is still there.

Similar Experience

[MoP030]

I cant really remember the PIN for my bank account, but when i'm standing in front of the cash automat i remember the moves i have to do with my fingers without problem. If i wanted to remember the PIN as a number i can close my eyes and pretend to type it though, so there is a way for me to know it consciously.

Excellent!

[Phurd Phlegm]

Now even if I am tortured to death I can't reveal the password to my eBay account!

This should come in handy to all the other costumed crime fighters in the Slashdot community, too!

Sounds like that bit in "Johnny Mnemonic".

[Samurai Cat!]

Keanu gets all the data locked in his head, and the password is a series of images...

Password is the wrong word

[Anonymous Coward]

they should call it passphrase if you want people to use long passes

all the time websites/apps ask for a password it just re-enforces the insecurity of using a single word

8 character passwords/filenames should of died in the 70's

Great

[Pan T. Hose]

Finally we have something which is not vulnerable to the rubber-hose cryptanalysis. Now the attackers can brute-force me as hard and as long as they want and I will not be able to tell them my password even if I want to! Now I feel totally safe, because even in the case of the most inhumane torturing, I will take my password to my grave. It's like using fingerprints in ATMs so the thief has to cut my finger off instead of taking my ATM card in order to steal my money, except for the lack of gelatin exploit. This is great news. I can stop recommending Password Safe to my users now.

This actually makes a lot of sense

[darkest_light]

When I was taking Spanish in high school, my teacher always told me that recognition was a much lower mental skill than composition. This is true--years later I can still *understand* spanish, but I can't speak it myself. Having a password system that relies on this lower-order mental process is a great idea. Recognizing the correct password would be much easier than remembering it, but the process for cracking it would be just as hard as cracking an alphanumeric password if enough pictures were used.

That said, I do end up memorizing most things this way--I know pin numbers, telephone numbers, and even my password by the "feel" of typing them, and I usually can't remember what they are when I'm not using a keyboard or number pad.

been there, done that

[menscher]

About 10 years ago I had a password where I typed an easy-to-remember non-word with my hands shifted on the keyboard. I actually went over a year without knowing what my password was, until one day I accidentally typed it at a login prompt.

My bank-card pin-number uses a different trick. I just used four consecutive digits of pi. The trick is that they're pretty far into the sequence. Oh, and I made a mistake when I set it, so it's actually wrong. Oops. Guess it's pretty random, then. ;)

Re:been there, done that

[gnu-generation-one]

"My bank-card pin-number uses a different trick. I just used four consecutive digits of pi. The trick is that they're pretty far into the sequence. Oh, and I made a mistake when I set it, so it's actually wrong. Oops. Guess it's pretty random, then. ;)"

I reckon it's probably still four consecutive digits of pi... (and indeed would be, no matter which 4 digits you chose!)

Keepass

[DarkHelmet]

I keep a copy of Keepass with me on a USB keystick. It keeps all of my passwords in a secure place. Most of the passwords I have are 21 characters, generated randomly.

The only thing I have to remember is the password to get into Keypass and decrypt its database.

Sounds like Passfaces

[Beautyon]

Passfaces uses a similar idea; you can remember the faces that make up your password, but you cannot describe that password to anyone. It relies on your brains ability to recognise faces, and your brains inability to accurately describe the same faces.

Useless for the blind of course.

Odds?

[RonnyJ]

the chances of guessing it is 1/100,000

When you consider that the chance of randomly guessing a random 3-letter long case-sensitive password is 52^3 (1 in 140608), this really isn't that impressive.

Mnemonics

[Jadrano]

Maybe this approach has its merits, but it would make entering passwords a bit complicated, strings are easier to handle.

I would find it much more important that knowledge about mnemonic techniques become more widespread. As far as I know, people who take part in memory contests, where they have to remember long numbers, use systems wehere each number stands for something (a letter in the alphabet, which in turn stands for certain words), and they quickly construct a kind of story around the numbers. Human beings are very bad at remembering raw data, but they are quite good at remembering semantically connected concept. As long as people conceive passwords as a kind of words, perhaps slightly altered and with numbers added, it will always be difficult - either it is still vulnerable (dictionary attacks or even if the word doesn't exist phonotactic attacks exploiting the rules sounds can combine in languages) or it is hard to remember, especially if the password has to change from time to time. It would be much easier of people conceived passwords as phrases or whole sentences and use the first, second, last or whatever letters that make up the words of these expressions (and still add numbers).
For instance, I think it would be relatively hard to remember a password like 'dl3w5pwthbtceth', but if it stands for 'During [the] last 3 weeks, 5 people went to [the] hairdresser because their cats eat their hair' (absurd, but not really devoid of semantic content and therefore possible to remember). Next time, the password might be '3ohtehfsocatioh2jgu' (3 of [the] hairdressers tried [to] extract [the] hair from [the] stomachs of [the] cats and to insert it on their heads, 2 just gave up). The style of the sentences that should not be too obvious can, of course, vary.
That is easier to remember than things conceived as nonsense-words and practically impossible to guess. The transition from one password to the next is easier - the next phrase or sentence can somehow be connected semantically or pragmatically to the previous in the mind of the owner of the password in a way that isn't accessible to anyone else.

With the ubiquity of passwords in today's everyday life, such methods deserve much more attention.

Re:Mnemonics

[Skeezix]

I wrote a paper on using mnemonics which you might find interesting

Serious uses in oppressive regimes

[AmiMoJo]

In some of the more oppressive legal environments, such as the United Kingdom, the police can demand that you hand over your passwords. Saying "I forgot", even if you did, is not considered a valid reason for not doing so. Check out the Regulation of Investigatory Powers Bill.

Using this technique, it would be possible to prove that you could not remember the password.

Re:Easy 24 or more letter-number combinations

[Scarblac]

I use passwords from Nethack, e.g. #@d_..C# is me and my dog standing next to an altar with a centaur on the other side of the room. Not hackable by dictionary attack :-)

Kanji

[ThreeDayMonk]

This reminds me of Japanese kanji - and anyone who's studied Japanese will know what I mean.

It's far easier to learn to read a word in kanji than to write it down accurately.

This sounds like a similar phenomenon.

Re:Easy 24 or more letter-number combinations

[solicit]

Or use a one-liner perl regex as your password, easy to remember if you know what it does, but also not breakable by dictionary attack. :)

not effective for men

[muckdog]

This won't work at all. If its based on images, every male password will be boobs.