Slashdot Mirror
Picture Passwords More Secure than Text
Hugh Pickens writes "People possess a remarkable ability for recalling pictures and researchers at Newcastle University are exploiting this characteristic to create graphical passwords that they say are a thousand times more secure than ordinary textual passwords. With Draw a Secret (DAS) technology, users draw an image over a background, which is then encoded as an ordered sequence of cells. The software recalls the strokes, along with the number of times the pen is lifted. If a person chooses a flower background and then draws a butterfly as their secret password image onto it, they have to remember where they began on the grid and the order of their pen strokes. The "passpicture" is recognized as identical if the encoding is the same, not the drawing itself, which allows for some margin of error as the drawing does not have to be re-created exactly. The software has been initially designed for handheld devices such as iPhones, Blackberry and Smartphone, but could soon be expanded to other areas. "The most exciting feature is that a simple enhancement simultaneously provides significantly enhanced usability and security," says computer scientist Jeff Yan."
Excuse me while I gather the virgin sacrifice and assemble the pentagram required to solve your problem
...about drawing penises on goatse photographs?
:)
That would be one way to keep things secure though - it's hard for someone to guess your pass picture if they can't bring themselves to look at the background...
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
Well, they could just cover the drawing in asterisks.
Oh, wait.
...the reality is that this story should probably be tagged 'security through never-being-able-to-access-your-stuff-again'
Friend: "The NIC is misconfigured..." Me: "No prob, I'll just telnet in and fix it." *Silence*
8==D
Who'd have guessed you could use the same password in both systems?
At least my idea for a Dance, Dance, Revolution password authentication scheme is still intact.
Patent pending, patent pending, patent pending.
Worst Sig Ever
Draw the goatse man. That'll teach them to spy on you!
Now if only I could figure out how to paste that troll's ascii in here...
Obama likes poor people so much, he wants to make more of them.
Okay, so something like 99% of users are going to use happy faces for their drawn password. That'd be so difficult to crack.
The Generation
I'd say something witty here, but I'm not that bright.
I bet I could crack 75% of these right off the bat by drawing a cock or boobs.
I smell pictionary attacks!!
Imagine pictures of common passwords/objects being drawn everywhere on the screen at different rotations and scales in rapid succession.. or just a brute forcer which didn't even make legible images 99% of the time
Sounds like a pain in the nuts to me.
You're doing it wrong.
That doesn't really change the original statement. It would indeed be a horrific accident that turned him into a quadrupole, and it would probably be hard to draw stuff afterwards.
Slashdot - where whining about luck is the new way to make the world you want.
That might be a good idea until you get one of these messages.
Password expired, please change your name.
I could get that dolphin that they taught to paint (look it up) to sign my signature on a check and the bank would still take it. It doesn't even have to be words or letters. As long as someone scribbled my signature, they're not going to reject it so the check's good. Signatures aren't quite the same thing.
Now my 2 cents, I just design security systems that are so freaky and confusing that hackers just give up because it's too odd. The hacker or otherwise bad person just gives up and is like "wtf is it, broke or just haunted?" If someone made a software suite where you can design your own ridiculous security system with basically unlimited possibilities of whatever the user can dream up, people would have some pretty ridiculous security! Everyone here always complains about security through obscurity. You try opening a ridiculously large-bit-encryption archive file of mine when at the "enter the password" screen, you have to wave the cursor over the password field then type submit in it and click the exit button which reveals a crossword puzzle with only one valid word in it but you have to in fact click the squares so the highlighted letters form a smiley face then within 3 seconds, click on the password field then press tab three times which is the only wat to get you to the now unlocked, real invisible password entry box and type your password in stutter type (doubles of each letter followed by a backspace) and then press the red X in the top right to submit it and open the archive. You aren't getting into that archive! That's so screwy, someone would give up trying to figure out what the hell was going on in minutes. And good luck brute forcing it cuz that'll take all the computers on earth a couple hundred trillion years. Plus it's not that hard of a process to remember when you really think about it. It'd take someone who memorized it like 15 seconds tops to do it all and even if someone watched it, they'd have trouble remembering it or understanding it. They'd have to have a camera recording your keyboard and mouse synchronized with another camera watching the screen and also be able to guess the time requirements. Do all that with an incrementing password (like fishfish2 then next time it's fishfish3) at the end of it and they'd barely be able to solve it if you told them every step. Waaaaaaay better and more secure than drawing a picture on a low res grid.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
I beg of you.. Imagine the call..
User "I have forgotten my password"
admin "let me just reset it for you, the default password is a square with a star inside started at grid co-ordinates 0,3 going to 0,10 then down to 10,10... Don't forget to lift your pen at each courner"
Just kill me now please.
Oh no:
Password too simple. Password must be at least 8 strokes with at least one diagonal one and one wiggly one.
Sounds like you were being harassed by the handwriting nazis!
Hello? Stick men??? Come on. Everybody is going to use boobs!
That sounds like a great password for a Fortress of Solitude, but probably not feasible for mere mortals. I can't decide if you are brilliant or insane.
My first program:
Hell Segmentation fault
...And then get the password is too short error...
I can already see the movie scene where they crack the chief of the FBI's laptop by guessing his pictogram.
Stacey: Try drawing a massive cock..
Arnie: I'm in. Lets get to work
I wrote my first program at the age of six, and I still can't work out how this website works.
Some CAPTCHAs are so difficult that it seems only computers could solve them.
I'm all about security . . . but I'm lazy. So I'd probably just draw characters as well. But I'd draw four of them for security's sake. B==D