Slashdot Mirror
Picture Passwords More Secure than Text
Hugh Pickens writes "People possess a remarkable ability for recalling pictures and researchers at Newcastle University are exploiting this characteristic to create graphical passwords that they say are a thousand times more secure than ordinary textual passwords. With Draw a Secret (DAS) technology, users draw an image over a background, which is then encoded as an ordered sequence of cells. The software recalls the strokes, along with the number of times the pen is lifted. If a person chooses a flower background and then draws a butterfly as their secret password image onto it, they have to remember where they began on the grid and the order of their pen strokes. The "passpicture" is recognized as identical if the encoding is the same, not the drawing itself, which allows for some margin of error as the drawing does not have to be re-created exactly. The software has been initially designed for handheld devices such as iPhones, Blackberry and Smartphone, but could soon be expanded to other areas. "The most exciting feature is that a simple enhancement simultaneously provides significantly enhanced usability and security," says computer scientist Jeff Yan."
I'd have to train myself to remember the strokes to draw something with the same movements and pen lifts. Sounds like a pain in the nuts to me.
The movie "Safe House" with Patrick Stewart had something similar.
Excuse me while I gather the virgin sacrifice and assemble the pentagram required to solve your problem
...about drawing penises on goatse photographs?
:)
That would be one way to keep things secure though - it's hard for someone to guess your pass picture if they can't bring themselves to look at the background...
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
I doubt this will really work, most people when they draw and write so it slightly diffrent each time. They may have to sit down and aim exactly and prepare which will take too much effort for most people. I doubt this will take off its the old security vs convenience. At this point ill take the convenience of a text password.
I can't even consistently write my signature, let alone some arbitrary picture.
A normal signature is a picture drawn in a certain fashion with a specific flow and strokes.
We have had signature recognition for a while.
Whats new?
liqbase
You say that, but it's EXACTLY what you have to do to learn kanji or kana... or hanzi, for the Chinese.
That's right, there's a proper way to write every one of the thousands of characters, right down to stroke order and placement.
I wonder how many users will just end up drawing Stars, Hearts, and Smiley Faces?
-The world would be a better place if everyone had a hoverboard
If you have to draw a picture to login, it's going to be very easy for people to see what you're drawing just by being near you.
With typed passwords that is a lot more difficult.
Or you could add 2 alpha-numeric characters to an existing text password, for more than 1000 times security.
There are only so many places to start drawing your password on a picture and a human would recognize that. People would probably draw birds in the sky and dogs on the ground, right? Also, I would guess that people would make linear leaps with their pictures: someone will draw a bird, and not a fish, in a picture of a tree.
That said, I'm not saying that this isn't a worthwhile endeavor, just that it wouldn't necessarily be as secure as it looks at first glance.
Will we need to draw a new picture every 90 days?
How many people will use a picture password of a stick man, tree, or a happy sun?
...the reality is that this story should probably be tagged 'security through never-being-able-to-access-your-stuff-again'
Friend: "The NIC is misconfigured..." Me: "No prob, I'll just telnet in and fix it." *Silence*
I think most people will associate the same things to the same background (eg. flowers->bee) resulting in even less combinations... also, the universe of "drawable things" is smaller than the universe of words, and that is smaller than the universe of pass...
1. An artistically-inclined person looking over your shoulder might be able to draw your image about as well as you can. With a conventional keyboard password, I can block the keyboard with my body so others can't see what I'm typing, and I can pretend to press keys that aren't in my password so even if they can see, they are thrown off. There is less you can do to block a screen you have to look at to draw properly.
2. Some people's hands shake when they've had too much caffeine, most people's fingers get stiff when they've been out in the cold, and some people have degenerative diseases which make typing a one-letter-at-a-time proposition. Drawing would be very difficult in all of these circumstances. Perhaps this is why TFA says that 5% of users couldn't recreate their image within three attempts a week after first coming up with it.
I don't think this technology is going anywhere any time soon.
My truck is like a series of tubes.
8==D
Who'd have guessed you could use the same password in both systems?
At least my idea for a Dance, Dance, Revolution password authentication scheme is still intact.
Patent pending, patent pending, patent pending.
Worst Sig Ever
If you remove the background picture and the act of displaying what you draw to everyone within eye-shot, I've already done that at http://shaunwagner.com/index.html?page=Projects%2FJavascript%2FMouse+Password
Does it work? No. It is far too difficult to draw the same image twice without seeing what you are drawing. If you can see what you are drawing, so can everyone else - then they can draw the same image.
The previous comment is purposely vague and generalized, but all of the facts are completely true.
It's a small conceptual leap to go from this 1998 stroke-based password idea to the present idea of drawing a picture to capture strokes which are then turned into a password. Looks like prior art to me!
Some days it's just not worth chewing through the restraints.
That might be a good idea until you get one of these messages.
Password expired, please change your name.
I beg of you.. Imagine the call..
User "I have forgotten my password"
admin "let me just reset it for you, the default password is a square with a star inside started at grid co-ordinates 0,3 going to 0,10 then down to 10,10... Don't forget to lift your pen at each courner"
Just kill me now please.
Oh no:
Password too simple. Password must be at least 8 strokes with at least one diagonal one and one wiggly one.
But on the subject of security, how would these passwords be stored? One nice thing with plaintext is that you never have to store anyone's actual password, only the hash of it. I suppose you could still create a hash of "1. stroke 47degrees 3%, 2, stroke 270degrees 22%" or whatever the password device spits out, but it seems to me that as this system requires a more sophisticated way of interpreting fuzzily matched movements, there might be problems with this approach or it could introduce weaknesses.
:D ), adjusting lengths, perhaps. But this would probably have the effect of narrowing the password space making it easier to crack the passwords. I'm not an expert in this area, I'd be interested to know if they've thought about this or if anyone else knows a bit more about it.
You could use some algorithm to simplify the users drawing, rounding angles (I punned!
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
Yes. Also the picture will require at least one instance each of cross-hatching, scumbling, and stippling.
I can already see the movie scene where they crack the chief of the FBI's laptop by guessing his pictogram.
Stacey: Try drawing a massive cock..
Arnie: I'm in. Lets get to work
I wrote my first program at the age of six, and I still can't work out how this website works.
Some CAPTCHAs are so difficult that it seems only computers could solve them.