Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Wants To Give You A Rorschach

Posted by ryuzaki0 on from the sticky-note-to-put-on-your-monitor dept.

Preedit writes "Microsoft has set up a website that uses inkblot images to help users create passwords. The site asks users view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password. Microsoft claims it's a way to create passwords that are easy to remember but hard to crack. But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."

8 of 223 comments (clear)

  1. Slight problem with this approach by Enlarged+to+Show+Tex · · Score: 4, Insightful

    This method will not create passwords that are strong enough. A truly strong password should have at least three of the following, if not all four:

    Uppercase letters
    Lowercase letters
    Numbers
    Non-Latin characters (i.e. symbols)

    Every password I use has at least three, even for free-registration-required sites...

    1. Re:Slight problem with this approach by TubeSteak · · Score: 4, Insightful

      A truly strong password should have at least three of the following, if not all four: Only if there's a maximum character limit on the password.

      Or are you going to tell me that
      "atrulystrongpasswordshouldhaveatleastthreeofthefollowingifnotallfour"
      is not a strong password?

      I'm not suggesting everyone should use such a long pass, but what's so hard about implementing passphrases instead of passwords?
      --
      [Fuck Beta]
      o0t!
    2. Re:Slight problem with this approach by Rakishi · · Score: 2, Insightful

      A truly strong password should have at least three of the following, if not all four: Not really, you can just make you password longer and you are just as secure.
    3. Re:Slight problem with this approach by PresidentEnder · · Score: 2, Insightful

      26^10 > 95^5. Even if you restrict your password to only a few characters, you can get the same level of security as with many characters. You just need far more of them. Think about it: when we strip off all of our abstractions, everything is stored as 1s and 0s, right? (Note: Parent's point is good and right, if your password must be short, or you don't want to spend time doing the inkblot test, or you don't want to have to remember 90 characters.)

      --
      I used to carry a bottle of whiskey for snake bite. And two snakes. -Nefarious Wheel
    4. Re:Slight problem with this approach by ChatHuant · · Score: 3, Insightful

      This method will not create passwords that are strong enough. A truly strong password should have at least three of the following, if not all four:
      Uppercase letters
      Lowercase letters
      Numbers
      Non-Latin characters (i.e. symbols)

      That's just not true. Admins request this kind of nonsense to force a bigger password space with shorter passwords. Informally, the security of your password is given by the number of random bits you have. With ASCII passwords using only lowercase letters, you're adding less than 5 bits of randomness per character. Even worse, most people use real words as passwords, so they can remember them easily. That reduces the randomness even more and makes dictionary attacks feasible. Adding uppercase, numbers and symbols gives you an extra bit or two of randomness per character, but makes the password much more difficult to remember.

      Microsoft's method works around the password memorization by using the inkblots. The security is given by the much larger size of the resulting password. They get a password of 20 lowercase characters, say about 100 bits of randomness (less than that, because not all letter combinations are equiprobable - very few words I know begin and end with a q for example). A totally random password consisting of a mix of 10 symbols, numbers and different cased letters only gives you a bit less than 70 bits of randomness.

    5. Re:Slight problem with this approach by AeroIllini · · Score: 2, Insightful

      Because many people have trouble typing their own names correctly without using the backspace key a few times, and typing a password in a box gives no visual feedback. Higher letter count gives a higher chance of typos, and a higher chance of getting locked out after typing "atrulystrongpasswordshouldhaveatleastthreeoftehfollowingifnotallfour" five times in a row.

      Chances of a typo are even higher if someone routinely types in MS Word with AutoComplete turned on and is now physically incapable of typing "the", "from", or any number of words correctly the first time. Double bonus points if they work in a major corporation and hunt'n'peck.

      --
      For security, the MD5 hash of this message and sig is 09f911029d74e35bd84156c5635688c0.
  2. Reusing the password by Culture20 · · Score: 4, Insightful

    "Nothing prevents a user from learning a strong password on Inkblotpassword.com and then reusing it at other sites," Microsoft's researchers said.
    Common sense might.
  3. Re:I'm shocked!!! by calebt3 · · Score: 2, Insightful

    Even if MS said that they weren't keeping the data, I'm not sure anybody would believe them.