Slashdot Mirror
Microsoft Wants To Give You A Rorschach
Preedit writes "Microsoft has set up a website that uses inkblot images to help users create passwords. The site asks users view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password. Microsoft claims it's a way to create passwords that are easy to remember but hard to crack. But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."
view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password.
I got vavavapsva.
More seriously, if they're saving the word associations, doesn't that mean that they have the password you've just generated?
If I have been able to see further than others, it is because I bought a pair of binoculars.
The blots are coded to shut your brain down if you don't have a valid regkey.
Slashdot is too nerdy for me.
Anyone wanna bet Ballmer's word list looks a bit like this:
chair
developers
chair
banana
ooohshiny
developers!
developers!
developers!
From the actual site:
Security and privacy of this service
InkblotPassword.com is a research project deployed by Microsoft Research. It is for demonstration and research purposes only. You are welcome to try it out, but we make absolutely no promise that our implementation will protect your password. Don't use your account here to protect any data you care about, from money to your reputation. We also make no promise that the site will continue running. Should the service prove successful, Microsoft may consider offering the service as a commercial product or service. For now, consider it an unreliable, insecure service run by a couple research coneheads in their spare time, and trust it accordingly.
Those who believe the Internet is private,
find their privates are on the Internet.
I usually suggest to people that they come up with a positive self talk phrase, take the first letter of each word, then replace a letter with a number that resembles it.
Something like "I am a happy person who loves their life." turns into "Iaahpwlt1", which is long, contains numbers and letters and no dictionary words whatsoever.
You end up repeating it to yourself every time you log in, which serves double duty as both a mnemonic device and a way to preserve your positive attitude.
-1 Uncomfortable Truth
I also highly suggest, right now, that everyone change your passwords to currentpassword x 3 or 4, or more:
For example, is passwordpasswordpassword any harder to remember than just password?
But it greatly expands the key space to be searched for anyone trying to brute force...