Graffiti as Password - Secure and Memorable

Al writes "A group from Newcastle University has released work that significantly improves the Draw-A-Secret method of creating passwords. The basic concept behind Draw-a-Secret is that humans excel at image recognition and memory, so 'passwords' should be designed to leverage that ability. The people behind the new work have refined the technique by parsing the shapes with a flexible grid and using existing images as a background to reinforce memory of the password. Imagine having your password be a graffiti-laden alteration of your favorite politicians campaign photo..."

Comments

More secure, less useful.

[srollyson]

It's tough to imagine hand-drawn passwords becoming much more popular than USB fingerprint readers. True, they increase security over standard text passwords, but how am I supposed to give a throwaway password to a coworker so that he can use my machine while I'm on vacation? The only thing that would make this more ubiquitous than fingerprint readers is the fact that you can use pre-existing touch screen or stylus interfaces as described in the article. In my opinion, this technology won't be able to fill the needs of anything more than a niche market. Nor will people need more than 640K RAM.

Re:More secure, less useful.

[vertinox]

True, they increase security over standard text passwords, but how am I supposed to give a throwaway password to a coworker so that he can use my machine while I'm on vacation?

Um... Not to side track. That is just a bad security practice. If you need to give your coworker rights to your computer, you give him rights to log into that work station with his name and password.

If he needs to get to your profile or files, then you simply give him the same permissions to access those files. In a windows environment, I would add him to the users so he could log into the machine locally and then set folder permissions to read/write to C:\document and settings\(my profile). On a Mac, I would give him read/write to my home directory. (Of course I don't trust my coworkers that much so I'd put the files they need access to in a single shared folder and let them have at that)

Of course you need to be on a domain of sorts and/or have rights to modify permissions on the files and folders that you own.

If you don't have the permissions to do so (which means IT security doesn't trust you), then I suspect your IT security would beat you with a large 2 by 4 if they found out you gave your password to a coworker.

Re:More secure, less useful.

[forkazoo]

Um... Not to side track. That is just a bad security practice. If you need to give your coworker rights to your computer, you give him rights to log into that work station with his name and password.

I don't disagree that the OP was suggesting bad practice. But, whether you are giving them the password for your account or for their own, you still need to allow somebody a way to initially authenticate, so they can pick something of their own. How exactly do you say, "Hey bob, I've set up an account for you, you can log in with the username bsmith, and the passdoodle... ummm... well, you sort of color in the bird, then outline a house over on the left, and..."

Re:More secure, less useful.

[Anonymous Coward]

Someone invented a third dimension a few years ago.

Myspace crackers would love this

[antifoidulus]

odds are the password of a 14 year old boy would be a spacegun, so that pretty much gives you control of half the accounts on there :P

Re:Myspace crackers would love this

[Aesir1984]

Spacegun? Having been a 14 year old boy at one point I can tell you it the password would be a picture of an attractive, scantily clad woman. Actually that would probably still apply today...

Re:Myspace crackers would love this

[tweak13]

odds are the password of a 14 year old boy would be a spacegun Is that what the 14 year old kids are calling it these days?

People are forgetting something

[gilesjuk]

Firstly, passwords are used a lot on the web. Having a password system where you have to draw limits the use of websites when using a mobile device.

Secondly, if people can't see they can't easily use a system where you draw.

Other problems are what language or plugin do you use? flash, java?

You also have to store this information in a database in some form. These methods prevent brute force attacks but won't stop people using SQL injection and other exploits.

Get off my lawn!

[exploder]

Man, I'm tired of all these complicated new password schemes...my bank uses "security code", a "password", and an image, plus they ask you personal questions that half of us don't even have a definite answer to, such as, "what was your favorite candy as a child" or "what's your favorite vacation spot?" Even if I do remember the answer, I have to remember whether I capitalized, and exactly how I typed it. What a pain in the ass. I get locked out of my bank all the time.

God dammit, just let me pick a nice strong password. I can remember passwords.

Enforcement Policy

[LiquidCoooled]

You must change your graffiti drawing every 7 days and ensure you do not use the same sequence of circles squiggles strokes or triangles.
Your graffiti sketch also must be greater than a house and a tree in complexity and has to include accurate birds and sunshine bars.

Re:Enforcement Policy

[SEWilco]

"a graffiti-laden alteration of your favorite politicians campaign photo"

Mustache is not sufficient alteration. Please redraw your password.

pain in the..

[Anrego]

I have a hard enough time typing in my plain text password in the morning when I get into work through my one blood shot eye.

I think it would be a major pain in the ass to have to draw a picture every time I wanted to log into my computer.

Re:pain in the..

[DarkIye]

...my one blood shot eye.

'Type in your password'? Why would a sheep farmer need to do that?

(Oh, god, I hope the moderators get this one.)

Dupe as password!

[EmbeddedJanitor]

That wouldn't be sucure would it?

Not as secure, IMO

[rustalot42684]

What happens when the person next to you looks and sees what you're drawing? The advantage of text-based passwords is that you can have them as stars or whatever onscreen. And if the users are unwilling / too stupid to make secure passwords (with numbers/letters/symbols), a drawing isn't going to be fundamentally more secure anyways, it's just a gimmick.

huh?

[religious freak]

I still don't get how these things are supposed to work, really. So you can draw a picture of graffiti and that's your password?

What if I can't draw?
How can you obscure this while "entering your password"? Seems like it'd be a lot easier to see than what someone is doing on a keyboard.
How much is the extra hardware going to cost and would the business want to pay for it?
Why not just do fingerprint recognition?
etc, etc...

Not a dupe

[phaunt]

No, this is not a duplicate, but an improvement on the Draw A Secret technology discussed there, as is stated in the summary:

The people behind the new work have refined the technique by parsing the shapes with a flexible grid, and using existing images as a background to reinforce memory of the password. This as opposed to the DAS technology, that uses a rigid grid and a user-drawn background image.

Re:Not a dupe

[damaki]

From the previous article :

By superimposing a background over the blank DAS grid, the Newcastle University researchers have created a system called BDAS: Background Draw a Secret. This helps users remember where they began the drawing they are using as a password and also leads to graphical passwords that are less predictable, longer and more complex.

I'd say less secure

[Kabuthunk]

I can't see how it's more secure. I'm sure many, many passwords will just be some random part of the background, like the bird or a tree, just coloured in.

Also... if we're so much better at remembering images, then one just has to glance at the screen someone is drawing on and then whoops... looks like they remember it too now.

Memorable?

[Bieeanda]

I don't know about anyone else, but even my signature tends to shift a bit every time I jot it down to take a delivery or acknowledge a credit card payment. Even something as simple as a circle is going to throw no-match errors, unless the system's got a lot of built-in leeway for curves and squiggles that aren't in precisely the right spot.

Re:Memorable?

[westlake]

I don't know about anyone else, but even my signature tends to shift a bit every time I jot it down to take a delivery or acknowledge a credit card.

This is the classic way of detecting a forgery. If two signatures are identical, one has to be a tracing. Any kid who was reading The Hardy Boys or Nancy Drew in the 'thirties would have been exposed to the idea.

Universal Access

[ddrichardson]

This system doesn't lend itself to those with visual impairment very well. In fact, having recently injured my right hand I have had difficulty writing, yet a fingerprint reader is still perfectly usable.

Oblig. Penny Arcade

[xenocide2]

What is delicious?

Done and Done

[Sir_Brysonic]

I just finished changing all of my passwords to "Graffiti". I'd better tell my friends to do the same!