Slashdot Mirror
Microsoft Wants To Give You A Rorschach
Preedit writes "Microsoft has set up a website that uses inkblot images to help users create passwords. The site asks users view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password. Microsoft claims it's a way to create passwords that are easy to remember but hard to crack. But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."
view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password.
I got vavavapsva.
More seriously, if they're saving the word associations, doesn't that mean that they have the password you've just generated?
If I have been able to see further than others, it is because I bought a pair of binoculars.
microsoft is collecting and storing the data. holy crap, batman, what next. the joker has plans to take over gotham city?
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
This method will not create passwords that are strong enough. A truly strong password should have at least three of the following, if not all four:
Uppercase letters
Lowercase letters
Numbers
Non-Latin characters (i.e. symbols)
Every password I use has at least three, even for free-registration-required sites...
It all looks like porn to me!
Engineering is the art of compromise.
So, psyche 101 was a long time ago, and that's the extent of my exposure to it.
Do individual people respond to the same inkblots, the same way over time? Or might I see the same splotch in 3 months and associate something else with it? If there's drift over time, this wouldn't be such a good idea.
Anyone with a better schooling in human psychology care to chime in?
Cheers
Lost at C:>. Found at C.
The blots are coded to shut your brain down if you don't have a valid regkey.
Slashdot is too nerdy for me.
For those who haven't seen it, Perry Bible Fellowship's take on this.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
why keep sending us to a crappy site like information-weak dot com its just a page of adverts and sales promotions information weak is certainly thats sites name
"Get out of my mind!" I think that the association data is much more valuable, or at least informative, than the utility of the particular password scheme they are touting. I wonder to what extent they will implement this? One to watch, IMO.
"Time is nothing; timing is everything."
db
I am literally 3000 tokens away from the chaotic crossbow --Stephen
where's the easy to remember part of it? Inkblots are so freaking random I think of something different every time I see one - course maybe that saying something...
Anyone wanna bet Ballmer's word list looks a bit like this:
chair
developers
chair
banana
ooohshiny
developers!
developers!
developers!
ouch
From the actual site:
Security and privacy of this service
InkblotPassword.com is a research project deployed by Microsoft Research. It is for demonstration and research purposes only. You are welcome to try it out, but we make absolutely no promise that our implementation will protect your password. Don't use your account here to protect any data you care about, from money to your reputation. We also make no promise that the site will continue running. Should the service prove successful, Microsoft may consider offering the service as a commercial product or service. For now, consider it an unreliable, insecure service run by a couple research coneheads in their spare time, and trust it accordingly.
So they have created a method for creating hard to crack passwords while simultaneously collecting the data to more easily crack them?
The cake is a pie
MS wants to give me a cool mask and let me eat beans from a can? Do I have to keep the journal too?
Virginia is for lovers. EVE is for griefers.
I went to the site and tryed it. but none of the images look like enything.
I just end up with frfrfr...
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
XXX#######
1a!A
Don't tell anybody, ok?
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
If this is anything like a wet willy, I don't want one, and you can't make me.
*runs away screaming*
I recommend using password agent software to generate and store all your passwords. It also keep password file 256 bit encrypted so no one else will be able to see or know your passwords withouts master passwords. It also provides autofill option so no keyloger will be able to capture the password. Its the best program. btw, i generate my password by typing randome characters on keyboard.
It's even more important that people not do this. If your password is the same for 15 different sites, and one of those sites gets hacked (or even phished, or someone keylogs your password) suddenly that hacker has access to your account at 15 different sites. This could ruin your whole day.
My truck is like a series of tubes.
Common sense might.
...is penguins.
FLR
IIS has performed an illegal operation and will be shut down.
I find it interesting when looking at passwords because it tells you a lot about the person. A computer person will have something like H2xkls23. Where as kid might have MyFavoritePony.
That site has one of the best captcha's I've ever seen.
Please select all the cats. Pictures supplied (and sponsored) by petfinder.com. Brilliant. Even HAL-9000 might not be able to do that.
It's not THAT unsafe. It shows cartoon breasts. Anyway, sorry if I got anyone fired.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
This is just a beta test for the m$ psychological evaluation system.
After reading the headline I got excited thinking Microsoft was helping to boost Watchmen popularity, damn.
(obligatory link for the uninformed)
Rorschach Inkblot Test
I think it would have been a little more clever if Microsoft did it in respect of their own password strenght good practices... If at least their algorythm randomized characters, like sometimes using an "i", sometimes using a "1", sometimes using capital letters. It's a classic, but it would have been a little more secure to have "trA1nIng" as a password, than to have "tgfryrmd". Brute forcing is a lot easier with only one character class...
I thought strong passwords avoided the use of words as they are subject to brute force dictionary attacks. An e.g. 8 character output of this method may be marginally more secure than one or two words that total 8 characters, but it is also very susceptible to a dictionary attack, maybe even more so as there is a good chance that animals and shapes would be the words chosen (not colours, names of people, verbs etc.).
Rorschach? Is that like a wedgie?
This guy's the limit!
...you really need a girlfriend
A goal is a dream with a deadline
Dog carcass in alley this morning, tire tread on burst stomach. This city is afraid of me. I have seen its true face. ...and I'll look down, and whisper, "No".:
The streets are extended gutters and the gutters are full of blood and when the drains finally scab over, all the vermin will drown.:
The accumulated filth of all their sex and murder will foam up about their waists and all the whores and politicians will look up and shout "Save Us!"...:
Lets hope nobody did. It doesn't "just show breasts" it shows graphic fucking. I'm sure some PHB somewhere will take offense. When in doubt, add a "NSFW"!
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
The image associations are not only unique to the user, they're also "hard to forget," the researchers said. "After typing her password several times, a user develops 'muscle memory' and can log in quickly without referring to the inkblot images," they said.
No shit. Type any password enough times your fingers learn where the keys are, even if you're not consciously thinking about what you're typing.
So their aim is to have you look at the inkblots, work out your passwords, type the password until your fingers get it, and then you don't have to look at the inkblots any more No numbers, no mix of uppercase and lowercase, and no punctuation. Doesn't sound particularly
Running APG over a web interface and getting pronouncable, strong passwords which will develop into muscle memory just as easily sounds like a much better solution.
Not to mention the the whole "oh btw, we're storing your associations" bit. It should be painfully obvious that when it comes to security, Microsoft simply doesn't "get it".
"And then I visited Wikipedia
Looks like it's been /.'d. Strange as I thought it was an MS site (although IP 72.44.41.236 goes to Amazon.com).
Thought: why doesn't /. get /.'d?
First time i read the subject, my brain interpreted it as "Microsoft Wants To Give You A Horseradish" http://en.wikipedia.org/wiki/Horseradish "The horseradish root itself has hardly any aroma. When cut or grated, however, enzymes from the damaged plant cells break down sinigrin (a glucosinolate) to produce allyl isothiocyanate (mustard oil), which irritates the sinuses and eyes. Once grated, if not used immediately or mixed in vinegar, the root darkens and loses its pungency and becomes unpleasantly bitter when exposed to air and heat." Seems somehow appropriate...
That's a TV Guide description for the Made-for-TV movie version
Watchmen - 74 minutes
"Guy with black and white mask eats beans from a can"
A goal is a dream with a deadline
Graphic fucking? Is that what you saw in that inkblot? You've got a dirty mind!
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Dot Matrix...
Is this really new?
Eventually it'll be something done by Open Source from the future SeaCode employees...
But, also, hasn't this been show in Sci-Fi shows? (No, I'm not talking about "cheating" to make a result/action appear on screen). It would be ghastly if a patent is "awarded" for this...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
secure?
An Ink Blot Test, brought to you by the folks who help protect and secure us of from the past, present, and future evil hackers. (The Ink Blot Test is obviously the best way to secure an operating system. Just see your physiotherapist today and "Poof" you are secure.)
Go figure...
No shit!
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
Oh great. I have to match my wild-ass guess of a past time with the precise values I chose in my WAG. Sounds like a nightmare.
Bill Gates sitting in a wooden school desk with his arm raised yelling "OOhhhh, OOOOhhh, OOOOOhhh, Mista Kahttah, Mista Kahttah!".
You're right I feel better already! Wow everything feels faster! Any more exclamaitions and I'd be using Yahoo!!
Engineering is the art of compromise.
I use a keyboard pattern mnemonic for all my passwords that I change every six months (work-pattern, bank-pattern, overseas accounts pattern ...).
... I sometimes forget the pwd, but I always guess right by the third time (most on second try).
Any 12 characters (1a...!A...) I never repeat, but I always recall, because of the pattern matching I must always recall the first character to enter, then I follow the appropriate pattern-match.
When I take vacation and return to the office two weeks later
Example: c6b8g7j9C^B*J( [works everytime 4me]
!HAVEFUN!
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Possible Microsoft ink-blot results:
It must have been something you assimilated. . . .
db
I am literally 3000 tokens away from the chaotic crossbow --Stephen
I was told that I am not allowed to teach this method to my colleagues, but I think most know it already.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Seems like an idea I came up with in May 2005: http://www.halfbakery.com/idea/Rorschach_27s_20Password I accept checks, Microsoft.
"Emo, what does this inkblot look like to you?"
I said, "Oh, it's kind of embarrassing."
He said, "Emo, everyone sees something, so don't be embarrassed. Tell me what the inkblot looks like to you."
I said, "Well, to me it looks like standard pattern #3 in the Rorschach series to test obsessive compulsiveness." And he gets kind of depressed.
I said, "Okay, it's a butterfly." And he cheers up.
He said, "What does this inkblot look like?"
I said, "It looks like a horrible ugly blob of pure evil that sucks the souls of man into a vortex of sin and degradation."
He said, "No, um, the inkblot's over there. That's a photo of my wife you're looking at."
"Oh," I said, "was I far off?" He said, "No. That's the sad part."
Pin numbers:
Open a large book on random pages and note down the LAST digit. Repeat until the pin is long enough.
For passphrases:
Pick a book, open it on a random page and note down the first word on that page longer than 3 characters. Generate 2 pass phrases this way and insert the acronym of one of them into the other. Add some random special characters and numbers at random places (i.e chosen as for pin numbers ).
May well be vulnerabilities in there, but if you know enough about computer security to avoid exposing yourself to orders of magnitude greater ones, then chances are you are able to generate a good pass phrase.
Just had a similar discussion elsewhere:
http://supergenpass.com/
Insert
"Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes."
If it's for a bunch of forums, whoop-de-fuck. If you're using the same password for banking as you do for blog posts, what in the hell is wrong with you? Even Bruce Schneier uses the same password for multiple low-priority sites, and uses different, better passwords for sites where it matters more.
My blog. Good stuff (when I remember to update it). Read it.
Example:
My brothers initals ar JaL and FdL
My Wifes Birthday and month 01/01
My first toby was 'Toby'
dd a letter to rotate
yb0T0101JaLFdLa
Bam, I just created personal and hard password. The bibbes argument against that is that 'everybody knows all about you'. In that case, this information is just noise in the data.
or
!5b00B_g1B
Easy to remember for a human.
No, none of the information given in the example is accurate.
Also, put the password in your wallet. You do not need to put what the password is to, you'll remember it.
The Kruger Dunning explains most post on
Most of my passwords are for sites that made me register.
The data on the account is fake, and of no value to anyone.
Not if that password is hashed with a properly complex, salted hash algorithm.
Duck!
I may not be a smart man, but I know what an inode is.
is that although the directions clearly tell you to put in the first and last letters of the word the inkblot makes you think of, you can input numbers, common symbols, and even weird symbols ( and f are both considered valid inputs, for instance) and it doesn't even flinch. I suspect these researchers are going to have to sift through a LOT of bad data to get any kind of meaningful results.
Unpleasantries.
WTF? Yet another annoying captcha. Half the pictures are so shitty I can't tell if it's a dog or a cat.
I'm just leaving my password at "changeme" and getting on with my life.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Something like:
username: Exo5Aiqua0pa
password: mypassword
With Windows Vista, I find myself frequently thinking: hmmm... this looks a little like a network configuration dialog box... no, wait... it's the network status box... no, actually it looks more like... etc.
I'm not really sure VaginaVagina is all that secure of a password ....
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
That is just silly... I spend too much time trying to think of what these inkblots look like, and some of them really don't look like anything.
Try a leet password generator... way easier to remember!
No, this person is clearly referencing Virginia, Virginia, Virginia, Pennsylvania, Virgina. Duh. Get your mind out of the gutter!
A dictionary attack is based on knowns (words in a specific language/dictionary).
... I suspect, that being able to change and maintain complex passwords not related to personal info for work/banks/hobbies... creates reasonably secure pwd and meets any OS/website requirement for pwd complexity.
A QWERTY-pattern mnemonic does not fit into any dictionary word pattern, whoever would need to use a brute force attack on the complete QWERTY-board, unless they knew your pattern. Also, I use the shift-key either alternately, 1st half or 2nd half, or maybe it is when I hit the 3rd key or maybe number a second time. The pattern, I recall, but the sequence is a little odd
So, yes, I think they are almost as secure as a random pwd, and far better than any pwd in use by boss/management personnel.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Wouldn't be the first time I got fired because of breasts.
The Kruger Dunning explains most post on
"penguin"
"and this one?"
"penguin"
"this one? this one?"
"penguin penguin"
"what about this one?"
"Ubuntu logo... on a penguin"
"But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."
So we all should pick "fufufufufu".
Rorschach's Journal. December 5th, 2007:
...and I'll look down and whisper "NAK!"
OS carcass on a hard drive this morning, random characters across its boot sector. This internet is afraid of me. I have seen its logins in the clear.
The passwords are in dictionaries and the dictionaries are full of "password", and when the accounts finally are taken over all their mothers maiden names won't save them.
The accumulated malware from all their pr0n and Myspace visits will load up about their processors and all from Tron Guy to Chuck Norris will look up and shout "reset us!"...
R.
(1) random word list
(2) slashdot userbase
(3) ???
(4) profit!!!
OK, jokes aside, poison the cache. Because you can.
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
can I make a mask with it?
...the password selects YOU
"But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."
... }". So if they select prudent sizes for their integers, they can probably encode their entire response catalog in 5 bytes.
Well, that only makes sense. They can simply assign each association an index and store the index instead. A great space savings there.
To illustrate this principle, consider that they will now only need to store the assigned Id value (probably '1') to user's recorded association response "FUCK YOU" as one byte.
Then to further save on space, they'll use another compression technique, known as "Run Length Limiting" (or RLL) to save space by encoding the number of times that value has been recorded, which will be implemented in a bit of code along the lines of "For (Every_User) DO {
I don't think I pass the raw shock test
Worst. Signature. Ever.
No, that one's a dog...
IDGI. Why are they using cat captcha to front end this?
There's no way a screen scraper is going to be able to get past the password selection.
First, it doesn't matter that they're storing associations, what they're storing is the first and last letters of the association, for 10 associations.
Second, I don't think even Richard Feynman would be expected to get past the password selection process.
* The inkblots don't really remind me of anything. I guess I haven't done enough psych tests or something, but they all look like masks to me, and "mkmkmkmkmkmkmkmkmkmk" is probably not a good password.
* You have to come up with the *same* associations over and over again?
I fail this test, it would be easier to simply memorize a random string of letters.
That must be a mistake in the response headers - surely they are using Apache.NET and IronPython. Or maybe...oh, wait...that must be a fake Microsoft? No way this can be the real thing!
Ezekiel 23:20
... You type your password in, but you don't type in the word association. It only stores the two letter sequence that you associate with each blot.