Slashdot Mirror
Tactile Passwords vs Shoulder Surfing
holy_calamity writes "Entering passwords using a tactile interface would remove two of the main vulnerabilities of using keyboards and alphanumeric passwords say UK researchers. They're using sequences of tactile icons on a VTPlayer tactile mouse instead. Shapes are displayed using the 16-pin tactile displays under the user's fore and middle fingers. As well as being almost impossible for anyone else to observe, tactile passwords can't be guessable in the same way as many conventional ones, they say. A video shows it all in action." Not that the video really helps explain it very well.
8 of 13 people found this answer helpful. Did you?
You don't need any special tactile mouse. The same could be achieved using a clickable image map showing a keypad with the numbers in random locations. You get a different map each time you enter the site. So keyloggers wouldn't be of any use.
davecb5620@gmail.com
No wonder that the video does not help to explain it very well. TFA says "it is almost impossible for anyone else to observe"
suffers a melt-down @ 8:35am EST on Monday morning.
The cesspool just got a check and balance.
then there are better ways to do it.
Also vulnerable to all other methods to obtain passwords except over the shoulder,
Whistler: Fellas, Janek's little black box is on his desk between the pencil jar and the lamp.
Mother: Uh, Whistler, I hate to tell you this, but you're blind.
Cool though this tech is, there is nothing so clever that fools can't render it worthless.
Meta will eat itself
Being bored at work, I took up using the Dvorak keyboard layout. My passwords however retain the same unconcious keyboard patterns as they did on a standard keyboard. Without even thinking of what my password is I can type it. For a while I didn't even know my own passwords were... this proved to be a problem when i had to check email and wasn't at my computer. But it definately ends the shoulder surfing for passwords.
I ended up typing my passwords a few times in notepad and memorized the gibberish that is my password now. Other than that I'd have to be trying to know what my fingers are pressing when i go into password mode.
16 mechanical pins, that is 16 bits of information, two bytes, typically equialent to two ASCII characters. Most passwords are required to be at least five characters. Add to that the fact that many pin-combinations are not useable because they are hard to distinguish, I would guess that amounts to maybe a few hundred usefull passwords. Not so secure then is it?
assignment != equality != identity
In the case of normal humans, I agree with you regarding shoulder surfing not being a horrible problem.
However, with the arrival of smaller and smaller video recorders, this could indeed be a decent solution for those forced to use passwords at terminals in (more) public places.
Though, the smaller entropy pool would likely become a problem if measures aren't taken to counter brute-force attacks...
This obviously won't work for someone without the use of both hands, or who has the feeling removed from their hands (a stranger?). However the biggest problem I would see is for the everyday person who may not be able to tell enough of a difference between each touch thingy to be able to enter their touchcode reliably a majority of the time. Though I suppose we'd learn if we had to, it just seems that the main reason why the blind get really good at reading braille is because they don't have a choice, not to mention they have a lot more processing power from their brain going to their other non-visual senses.
This device is a very nice and tender approach to a problem.
Sort of like killing a fly with a bulldozer.
I suppose the solution to this paradox is that the tactile mouse will display pointer only during tests, and in actual situations nothing will be observable.
That could make it hard to quickly enter a password even if you know it.
-------
The biggest flaw of this method is that it does nothing for keyloggers. Yea, maybe if your boss wants to know your password by peaking over your shoulder, it'll help.
It won't help to protect you from your competitor or a black hat hacker who installed spyware on your PC.
This will sound crazy. But, I recently saw a review for a keyboard that had little organic LCDs for each key. Now, I'm not saying thats a good idea, infact, it sounds like a huge waste of energy. However, you could do what other people are suggesting, and that is change the key map each time, and have those little screen personal protector things on it. I forget what they're called, but you can buy them for your PC, and laptop, monitor, and it will reduce the viewing angle to the person sitting immediately infront of them. Hence, you can see your keyboard, but no one else can.
... no one has thought of the lepers.
Let's just put small DNA testers on each PC.
Then all you have to do is stick something in the hole to donate a blood sample.
--
Stupid people breeding has lead us to the current government
-- I am the NRA, enough said...
I dread to think what the "tactile" password for a pr0n site would be like...
I've always made sure that my passwords contain a string of easily-typable letters consisting primarily of alternating-hand homerow keys, to complement the numbers, punctuation, and capitalization elsewhere in the password. Since you can tap out those letters so quickly without moving your hands around dramatically, it makes it much more difficult for anyone to eyeball your password.
I've seen countless stories about dedicated password-entry hardware, but none of them (with the minor example of insecure fingerprint scanners) have made an impression. Purpose-dedicated hardware rarely does.
-3Suns
~~~~
The Revolution will be Slashdotted
Won't these types of access codes be even harder to remember?
Imagine these at a job where you're forced to change codes regularly.
> On average, the volunteers took 38 seconds to log on
So now I need about 4 to 5 seconds to log on. (Just tested it)
Considering that the system needs a special mouse and a special login interface, too, why not get a mouse with a finger print reader and use that login interface?
I would also imagine Joe User will be trained faster to "put your finger there, dude", then to feel and remember the tactile pattern.
I'd say a lot of office users use the same password all over the place (although they shouldn't). IBM's finger print reader on the notebooks gets rid of the shoulder surfing password issue to some degree. This helps reduce casual password 'lifting' I'm sure. Does the fingerprint reader count as a tactile interface?
http://www.virtouch2.com/images/Playing_Space_War. jpg
Is it me, or does that guy's shirt say "LOL Bear"?
I like the point. Hate you, but like the point.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
...he decided to show off how cool and tough he was by posting anonymously at Slashdot!
Clever signature text goes here.
...sure they can. I used to be very shy and withdrawn back in the late 80's and early 90's. Once I got online, got social on USENET, IRC, and such, it helped me develop -how- to be social offline as well. Doesn't replace true meatspace social aspects, but at least for me, computers -did- help me be assertive and have confidence in my interactions.
As a radio amateur (old school, 20 words per minute Morse), I would be very happy to key in my password entirely on the "J" key.
Fiat Lux.
We praise ourselves of being very fluffy clever, nevertheless we haven't squared a simple solution to the authentication problem.
Or maybe there are no simple solutions, but people that are not familiar or comforatable with IT should not be denigrated for solutions that are clearly inadequate, difficult, or both.
IANAL but write like a drunk one.
Why not make authentication systems three factor: something you have - the card, something you know - the pin, and what you are - biometric -finger print. With the false +ve/-ve rates you can't rely on finger print readers alone but combined with the other two factors you can make a secure system which even if I give you my pin is no use.
;).
Make sure though the fingerprint key is not stored on the card
--- Users are like bacteria -> Each one causing a thousand tiny crises until the host finally gives up and dies.
Mock-slutty half-drunk teen girls singing Britney Spear's Do Somethin'
Okay, I dunno if they're half drunk, but they are two mock-slutty girls singing a Britney song.
What do you expect? I just did a youtube search for britney lip sync. You'd be surprised how many guys lip sync to Britney Spears; I had to scroll down pretty far.
:(){
Hey Dude. Back off!
:P
See. It can be done on Slashdot too
Don't forget the blind people. They must be able to sense the '5' key. It's a requirement when designing a payment terminal.
Type this in a term: *
ps -A |md5sum
This will ALWAYS give you a different result, and it is not reproducable/predictable.
*Windows users need not apply
Now, to 'remember' is a different story. I'll let you figure out your own method.
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
...by malware.
k site_ke.html
http://www.boingboing.net/2006/09/18/onscreen_ban
"The novelty of this trojan lies in its capacity to generate a video clip that stores all the activity onscreen while the user is authenticating to access his electronic bank.
The video clip covers only a small portion of the screen, using as reference the cursor, but it is large enough so that the attacker can watch the legitimate user's movements and typing when using the virtual keyboard, so that he gets the username and password without going into further trouble."
Sure, last gen keyloggers wont capture passwords entered via this interface, but the current gen sure will.
When memorizing a password, I think length is more important than the number of possible symbols at each position, when it comes to difficulty of memorizing. Memorizing 10 decimal digits is easier than memorizing 32 bits, for example.
I used to support Point of Sale systems at a local sporting goods chain, and often would be at the store working with the manager hanging around learning what they could (always appreciated.) I had a great boss, and she gave me a graceful technique for avoiding shoulder surfing in that situation. You have to be able to touch type your passwords.
Talk to the person, and look them in the eye while you type your password.
Not gonna work for all situations (ATM Pin) but incredibly effective where there is only one person who really presents a risk, and really, how often are you working in a crowd?
OK, Classrooms just suck, so you have to rely on flying fingers sometimes, but I did find it to be useful when "that kid" was hanging around the same way. "That kid" could be a proto-geek, or a hacker wannabe, but I always did what I could to educate and make conversation. Hey, you're interested? Cool! Kids (even teens) respond really well to being treated like people. And, the conversation made it easy to type my password without _him_ seeing it. No need to tempt 'em.
Assembly is the reverse of disassembly.
http://www.artlebedev.com/everything/optimus/
Might be perfect for such a situation, with a firefox extension to change the keys.
Can't somebody just make a pane that is transparent to someone standing on front of the keyboard, but not visible to anyone outside of a very small viewing angle? For example: a thick mesh it visible only from straight-on. From other angles you see the sides of the mesh.
We need laser beams that can find prying eyes and burn them out of the owners skull. That would put a stop to it.
BTW: If anyone finds such a technology let me know. I need this for what I'm surfing slashdot at work too.
Dedicated Cthulhu Cultist since 4523 BC.
What you describe has been done, but why not just rely on touch-typing and make it impossible for ANYONE to see the keyboard?
Don't thank God, thank a doctor!
I can use my erect penis for a tactile password? My pecker tracks will type out: LET ME IN.