Slashdot Mirror
Recognizing Your Own Handwriting As A Password
Gary writes "A new online authentication system called Dynahand could make logging in to websites a little easier. With Dynahand, users simply identify their own handwriting, instead of entering a cryptic password or buying a biometric device to scan their fingerprints. The user's handwriting samples contain only digits, since numerals are harder for an outside party to recognize than letters are. The digits displayed are random, so the handwriting is the only clue to the correct answer."
...who virtually cannot write by hand anymore? I can't even write a proper signature, haven't been using hand writing since I was playing RPGs 10+ years ago.
I'd say it would be pretty hard to determine how my digits would look like.
Probable impossibilities are to be preferred to improbable possibilities.
Aristotele
This would make brute-forcing a password a little easier..
An attacker could simply select a hand writing at random till they get the right one.
TFA doesn't say anything about that.
As novel as this whole handwriting angle is, doesn't this just amount to a multiple-choice test? There's always the off-chance of some random stranger getting in by sheer luck.
Additionally, that's not taking into account the massive amounts of ways someone could get samples of your handwriting. Besides the obvious garbage-picking, things like tax returns, property deeds, or other legal forms can often be public information, and there's a good chance you've written numbers on one at some point.
Slashdot Burying Stories About Slashdot Media Owned
I am not a cracker. I am not a phisher. I do not try to get into random people's accounts.
I can't help thinking that IF I ever did try to get into someone else's account, it would be to spy on or get revenge on someone I know. (Really, that isn't something I do. This is a big IF). In those cases, this would surely be so much easier. For example, I am sure I would recognise my family's handwriting.
I certainly remember, when I was a secondary school maths teacher, having to work out who had produces a certain piece of work by recognising the handwriting. Obviously, being maths work, this usually involved recognising digits.
Passwords actually strike me as quite a good security method. A good password is difficult to guess by a person or by a machine and is very simple to implement, leaving less margin for error in the technology.
I know, I know, people forget their passwords or choose the word "password" all the time. It still seems a little depressing that we have to use all this extra trickery to compensate for people being morons.
Peter
1. It's a shared secret. That's all. I was going to say "no better, no worse", but actually it's made significantly worse by being multiple choice.
2. Doesn't prevent MITM in any way whatsoever
Now the biometric of someone's typing rythm strikes me as a good thing, along with "PC fingerprinting" and trend analysis, but this suggestion is significantly worse than what we already have available on the market.
"3/10 - see me" would be my mark for this particular gem.
I've got a simpler idea, why don't we just ask people a simple true/false question. I've got the first:
A single html radio-button form-based multiple choice question is a reasonable security measure.
A) True
B) False
But I think there should be an option "C," though that would make this not a real t/f question:
C) WTF?!
Those who have telepathy have no need to RTFA.
What, now I have to bring a typewriter everytime I go to the restaurant - to fill in the tip and total?
I could quite easily recognize my own...But so could anyone else who has ever seen it. Then there are those people with bland, unmemorable handwriting...How would you pick your handwriting out of a crowd when your handwriting looks like handwriting is supposed to look.
Additionally, the number of samples would have to be constrained to what a normal person could be expected to go through, so the odds of someone being able to guess it are huge. I mean, I could set my password to the crappy "Guess,15" and it would take millions of brute force guesses to figure it out, as opposed to checking 20 something handwriting samples.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Back in the late 80's, a UK bank did some R&D on this area and came up with a novel idea. It was signature recognition BUT rather than analysing the actual signature, it 'listened' to the pen on the paper as it moved. They found that anyone (well.. some people anyway) could do a fair replication of someone else's signature if they went slowly but it was almost impossible to recreate someone's signature at the same speed and with the same pressure/flourishes.
In case anyone reads this and copyrights the damn thing, there is prior art and it worked. They just didn't think the market was ready for it.
I want a list of atrocities done in your name - Recoil
Here's how you crack it:
1. generate a bunch of new sessions to the login page.
2. Identify samples that appear more often than others.
3. Recognize the handwriting style.
4. Log in.
Because it wouldn't help them.
Almost 15 years ago, I was working on a demo system for a more secure way of issuing benefit payments (at the time, the payee had a paper booklet, and there was quite a lot of trouble with stolen booklets). We investigated what we could practically put on a smart card (similar type of smart card as what is in modern credit cards). One of the things we investigated was signature recognition.
We had a system that did it extremely well, well enough that we never managed to forge another person just signing with an "X". The system not only looked at the shape of the writing, but the way the person wrote - the speed, accelerations, stroke weight etc. The genuine user could be recognised even if they signed fairly scruffily (the system didn't return 'true' or 'false', but rather a confidence). However, another person even if they signed their X to LOOK as much as the original person's X looked would get a very low confidence score.
This was almost 15 years ago - the technology was pretty damned good (but quite expensive) at the time. We managed to get the signature, the person's details and a photograph onto the smart cards of the day (I think they had 8K of storage). The signature took up 1K.
Oolite: Elite-like game. For Mac, Linux and Windows
There is no improvement here over biometrics or other credentials falling into the “something you are” category. How do you revoke this credential? How do you limit its scope? I would even argue this is worse than a password because it is not easily changed, and worse, your signature is very public. Consider how many documents you have floating around with your hand-written signature on it. You really want to use something that can be learned and easily reproduced as a secret? Nonsense. We need real solutions (OpenID is a start), not rehashes or regressions of old schemes.
Why bother.
Exactly. In the old days, someone would have to find the stickynote on one's monitor that specifically had one's password written on it. Under this scheme, any stickynote at all will do!
From the article's first paragraph:
...
You can't afford to be careless regarding the password coz you never know
And with that, I stopped reading. Why? Because I don't have enough time to read things that aren't written in at least passable English. If someone has a good idea, and are serious about it, they'll make the effort to communicate it well or have it communicated well for them.
Nothing to see in this article, and, by strong implication, a worthless idea.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.