Slashdot Mirror
Picture Passwords More Secure than Text
Hugh Pickens writes "People possess a remarkable ability for recalling pictures and researchers at Newcastle University are exploiting this characteristic to create graphical passwords that they say are a thousand times more secure than ordinary textual passwords. With Draw a Secret (DAS) technology, users draw an image over a background, which is then encoded as an ordered sequence of cells. The software recalls the strokes, along with the number of times the pen is lifted. If a person chooses a flower background and then draws a butterfly as their secret password image onto it, they have to remember where they began on the grid and the order of their pen strokes. The "passpicture" is recognized as identical if the encoding is the same, not the drawing itself, which allows for some margin of error as the drawing does not have to be re-created exactly. The software has been initially designed for handheld devices such as iPhones, Blackberry and Smartphone, but could soon be expanded to other areas. "The most exciting feature is that a simple enhancement simultaneously provides significantly enhanced usability and security," says computer scientist Jeff Yan."
Excuse me while I gather the virgin sacrifice and assemble the pentagram required to solve your problem
I doubt this will really work, most people when they draw and write so it slightly diffrent each time. They may have to sit down and aim exactly and prepare which will take too much effort for most people. I doubt this will take off its the old security vs convenience. At this point ill take the convenience of a text password.
I can't even consistently write my signature, let alone some arbitrary picture.
A normal signature is a picture drawn in a certain fashion with a specific flow and strokes.
We have had signature recognition for a while.
Whats new?
liqbase
You say that, but it's EXACTLY what you have to do to learn kanji or kana... or hanzi, for the Chinese.
That's right, there's a proper way to write every one of the thousands of characters, right down to stroke order and placement.
I wonder how many users will just end up drawing Stars, Hearts, and Smiley Faces?
-The world would be a better place if everyone had a hoverboard
If you have to draw a picture to login, it's going to be very easy for people to see what you're drawing just by being near you.
With typed passwords that is a lot more difficult.
Or you could add 2 alpha-numeric characters to an existing text password, for more than 1000 times security.
...the reality is that this story should probably be tagged 'security through never-being-able-to-access-your-stuff-again'
Friend: "The NIC is misconfigured..." Me: "No prob, I'll just telnet in and fix it." *Silence*
1. An artistically-inclined person looking over your shoulder might be able to draw your image about as well as you can. With a conventional keyboard password, I can block the keyboard with my body so others can't see what I'm typing, and I can pretend to press keys that aren't in my password so even if they can see, they are thrown off. There is less you can do to block a screen you have to look at to draw properly.
2. Some people's hands shake when they've had too much caffeine, most people's fingers get stiff when they've been out in the cold, and some people have degenerative diseases which make typing a one-letter-at-a-time proposition. Drawing would be very difficult in all of these circumstances. Perhaps this is why TFA says that 5% of users couldn't recreate their image within three attempts a week after first coming up with it.
I don't think this technology is going anywhere any time soon.
My truck is like a series of tubes.
8==D
Who'd have guessed you could use the same password in both systems?
At least my idea for a Dance, Dance, Revolution password authentication scheme is still intact.
Patent pending, patent pending, patent pending.
Worst Sig Ever
Ordinary people have been doing this for hundreds of years. It's called a SIGNATURE.
lemonade was a popular drink and it still is
Sounds like a pain in the nuts to me.
You're doing it wrong.
That doesn't really change the original statement. It would indeed be a horrific accident that turned him into a quadrupole, and it would probably be hard to draw stuff afterwards.
Slashdot - where whining about luck is the new way to make the world you want.
I could get that dolphin that they taught to paint (look it up) to sign my signature on a check and the bank would still take it. It doesn't even have to be words or letters. As long as someone scribbled my signature, they're not going to reject it so the check's good. Signatures aren't quite the same thing.
Now my 2 cents, I just design security systems that are so freaky and confusing that hackers just give up because it's too odd. The hacker or otherwise bad person just gives up and is like "wtf is it, broke or just haunted?" If someone made a software suite where you can design your own ridiculous security system with basically unlimited possibilities of whatever the user can dream up, people would have some pretty ridiculous security! Everyone here always complains about security through obscurity. You try opening a ridiculously large-bit-encryption archive file of mine when at the "enter the password" screen, you have to wave the cursor over the password field then type submit in it and click the exit button which reveals a crossword puzzle with only one valid word in it but you have to in fact click the squares so the highlighted letters form a smiley face then within 3 seconds, click on the password field then press tab three times which is the only wat to get you to the now unlocked, real invisible password entry box and type your password in stutter type (doubles of each letter followed by a backspace) and then press the red X in the top right to submit it and open the archive. You aren't getting into that archive! That's so screwy, someone would give up trying to figure out what the hell was going on in minutes. And good luck brute forcing it cuz that'll take all the computers on earth a couple hundred trillion years. Plus it's not that hard of a process to remember when you really think about it. It'd take someone who memorized it like 15 seconds tops to do it all and even if someone watched it, they'd have trouble remembering it or understanding it. They'd have to have a camera recording your keyboard and mouse synchronized with another camera watching the screen and also be able to guess the time requirements. Do all that with an incrementing password (like fishfish2 then next time it's fishfish3) at the end of it and they'd barely be able to solve it if you told them every step. Waaaaaaay better and more secure than drawing a picture on a low res grid.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
Oh no:
Password too simple. Password must be at least 8 strokes with at least one diagonal one and one wiggly one.