Slashdot Mirror
Child-Suitable Alternatives To Passwords?
An anonymous reader writes "Two months ago I donated my old PC to my little sister, who is 7 — I had promised she would get her own computer as soon as she can read and write properly. I then proceeded to answer her questions about how it works, as far as she inquired, and tried to let her make some choices when installing Debian (she can already use GNOME). As I explained password protection and encryption to her, I was pleasantly surprised when she insisted on protection measures being as strong as possible, so that no one else can screw with her computer. She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent. The significant problem is that she cannot permanently memorize abstract passwords, even if they are her own creation. I talked with a teacher who assured me that this is common at her age. My parents would probably be able to guess non-abstract passwords. What mechanism of identifying herself does the Slashdot crowd suggest?"
Would a fingerprint reader be suitable?
A fingerprint seems like a reasonable idea. If she's just trying to keep other family members off of it, rubber-hose cryptanalysis is unlikely to become a problem, and she's highly unlikely to forget her fingers anywhere.
ttuttle is a rankmaniac
Have her make a pattern on the keyboard that she can remember. I've actually had a number of PIN codes that I didn't actually remember apart from the pattern they make on the numeric keypad.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
Why on earth should a 7 year old be able maintain privacy on a computer that can serve as a portal to many nasty things?
What doesn't kill you only delays the inevitable
I would suggest the parents have the root password, and their child can ask them to reset her password when she forgets.
Parents guessing the password of a seven year old is ridiculous, is this a serious question ?
Otherwise, quit undermining your parents and let them raise your sister. You can contribute if you want by teaching her about computers, but do it in assistance to your parents, not in opposition.
Seriously, she's 7?!
I have two daughters around the same age. They share a computer that we gave them for xmas. They have their own accounts, with their own passwords and my wife and I maintain the Administrator account. I could not fathom them having an Internet-accessible computer without us having full control over it.
Am I missing the point ? Because when I read:
"My parents would probably be able to guess non-abstract passwords"
it sounds to me like you're trying to keep a 7 year-old's parents off of a computer she uses when they have every right (and reason / responsibility in this day in age) to know what their young child is doing on a computer.
Of course I am all for teaching kids how to be security conscious and protect their private data. But it's a fine balance. Parents need to keep themselves in the loop in order to, you know, be effective parents.
Have her take a favorite book, start at a random page (or first page if she only needs to keep family members off.) Read the first letter of each page for 10 pages.
On a different topic, you said one thing that shocked me:
She's 7. I don't know how old your younger brother is, but at some age, it is a reasonable thing for a parent to do. It cannot suppliment for parenting, but it can be handy to insist on a website whitelist, or 2-hour cutoff.
Seven-year-olds shouldn't have the full rights of adults.
Your ad here. Ask me how!
I noticed the same thing. Also the quote how the brother had to "endure" parental control software. We're talking about a 7-year old. There should be parental supervision, education, and monitoring.
With phrases like "She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent" and "My parents would probably be able to guess non-abstract passwords" you are clearly trying to undermine your parents. I know that children, though you don't give your age, usually think that they know better than their parents, but guess what: it isn't usually true! I hope that your parents are smart enough to take your sisters computer away if you succeed in locking them out.
For instance, in high school I listened to Tomorrow Never Knows off of the Revolver record by The Beatles nonstop. Since I know every lyric of that song, I might pick the opening line: Turn off your mind, relax and flow downstream Which would render the password: Toym,rafd Not a bad password, in my opinion. You could do the same with the opening line of a book, quote from a movie, TV show or even a line from a poem. All of these things are very memorable and produce hard to break passwords.
My work here is dung.
The idea that it is reasonable to provide for a seven year old a computer to which no responsible adult has access is simply insane. If my nine year old floated that idea to me the MAC address would be barred on the home router in about two seconds, and all access offsite would be transparently proxied into squid as soon as I brought the appropriate instance on air. Anyone who permits a child that young to have unfettered access to the Internet should be sterilised, and anyone who aids and abets them should be treated equally harshly.
I agree. At that age, her dealings with computers (particularly computers with Internet access) should be closely monitored by her parents. She should set up a password and be instructed not to tell other people what it is in order to get her into the habit of good security practices, but her parents should nevertheless know the password (or some other way to access the computer).
Of course, my son is 8 and he's only allowed to use the computer in the living room, and we can easily see what he's doing on it at all times. Kids are already going to obsess about keeping things from their parents when they're teenagers, there's no reason to start building that barrier when they're only 7.
Something like 3ed4rf5tg (try typing it) or sxdcfvgb should do the trick. Starting with the first letter of her name might help.
How about:
mybigbrotherissuchageek
or
nowicantalktocreepsonlinewithoutmyparentsknowing
?
Why on earth does a kid of this age need a secure password?
This can be solved by giving the parents the root password and letting the girl keep a secret password. That makes it so that she gets the feeling of privacy and, for the most part, the reality of privacy while still allowing the parents to do and see whatever they want on the computer.
Yes, and I'm questioning two aspects of that:
Why the parents need to be kept out, and why the AC thinks that any password will keep out parents who presumably have physical access to the system.
If the parents are taking an interest in keeping young children safe, then by all means let 'em.
In Xanadu did Kubla Khan
A stately pleasure dome decree
Thank you to all who have pointed out that perhaps locking the parents out is not a sensible goal. While I think it is good for a child this age to understand the concepts of security and privacy, I don't think that it is reasonable for a minor to expect her own little private computing world, free of parental control. There should be some semblance of openness and trust in a healthy household, particularly between parents and their children.
Seven year olds love secrets and hiding places. Write the secret password on a piece of paper and ask the user to hide it in a very safe location. As long as the parents have the Administrator or root password to perform parental system audits (possibly only after bedtime), system management and password resets, I see no problem with the parents not knowing what the password is. All this, of course, assumes the parents are able to supervise use according to their parenting style and the child's needs.
Memory... a seven year old's is quite fluid. "My favorite food is steak" might morph into "My favorite food is ice cream" or "I like steak" or "I like eating" or "I like my little pony". Passphrases might be easier than g%jP22094jmqqlDMSk, but they're still memory-based.
Every login account on an internet-connected computer needs a secure password.
That judgement is learned, generally through the parents. And yes, you'll see lots of adults using their parents' poor judgement.
The second reason is that it helps prevent parent ignorance. If the parents participate in her "computer experience" they will become experienced, too. The younger kid had to endure safe-surf software because the parents didn't want to surf with the kid.
What gets me is that a 7-yo actually feels the need to hide things from her parents. This can be from watching her brother and deciding his frustration was bad, or it could be because she doesn't trust them so much.
Quit posting crap articles like this...this is obviously about a 14 year old boy that thinks his sister needs security from his clueless parents.
But then still, a child may need privacy, but the parents need to have a way to access it. Whether they should do it or not, that is another discussion. You are talking about a seven-year-old here. They need parental supervision, and a certain degree of control. Clear limits within where to operate. Keeping things secret as a child from their parents is one thing; completely undermining parents' controls is another. And with that I am not talking about the software based "parental controls".
Surely as the computer in question will be exposed to the internet, a decent password is required. But why all the effort of keeping everything inaccessible to the parents? That is going too far.
If your parents are totally and completely incompetent
"Unable to grasp how to admin a computer" doesn't necessarily mean "incompetent to raise a child".
Most kids have a much better understanding of modern technology than their parents (and I suspect that has always held true). She may legitimately worry that, in their laughable attempts to snoop on her activity, they'll actually cause some damage. The very fact that the FP involves her brother giving her a computer rather than her parents would tend to support this view.
quit undermining your parents and let them raise your sister.
I can tell by your tone that you won't agree with this, but like it or not, kids have a right to privacy. You can either honor that and perhaps they'll come to you when they have a real problem, or you can have them do the same things behind your back and consider you the "enemy" and the last person to go to when in trouble.
It always amazes me how selectively people forget their own childhood when they become parents - They seem to remember all the crap they pulled and want to lock the little bastards in their rooms until age 18, without remembering that when their own parents tried to do so, it provided the motivation to learn to pick locks.
You need to stay the hell out of your parent's business.
When you have a 7-year-old, feel free to lock yourself out of their PC.
Is it not, after all, a fundamental not only on Slashdot but of security in general that any security can be broken if you have physical access to the boxen?
In any case, I think as a primary corollary to your first question, one really needs to ask whether this is a decision that the submitter should be making with his sister. It seems to me, that with all of the talk on Slashdot about 'we must blame the parents who do not take care of their children', this is a decision the parents need to make with their daughter (or that she needs to make alone and can then argue with them afterwards about).
It seems like a ripe situation for family conflict when the (brother, presumably) interposes himself as he is doing here.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
You nailed it.
As a parent, there's no way in a hell a 7 year old will have a lock down to keep mom and dad out, no responsible parent will allow such a thing, and the machine gets taken away if such a practice is put into place.
When your 18, go right ahead and make the 53 ch4R@ct3R password to lock your machine up, until then, accept the fact that you are the child and we are the parent, and you don't get root access or personal and private encryption, you ask the IT department (dad).
Cheers.
This is my sig. There are many like it, but this one is mine.
As the parent of 2 children, I need to disagree with you on one big point: No. Kids do not have a right to privacy. Period. It is my responsibility as their parent to guide them and protect them and a big part of this is knowing what they are up to. I allow my daughter (12) to access the internet, but not to do IM or join 'social' sites. I also maintain the admin account on her computer (OS X). For my son (8) I allow him access to our LAN (for printing and multiplayer WCIII with his sister and I) but do not allow him access to the internet from his own system. To get to the internet he has to use my computer (in his own account).
Rather than trying to find ways around parental involvement, I think that the original poster needs to work _with_ his parents. Help them to set up the Linux computer for his sister and let them know how it is not susceptible to the same issues as a Windows box. Also, show them how to safely check up on the things that they are probably concerned about (eg; browser history, email addresses, etc.). This way _all_ of you can come out ahead and there is much more trust in the family.
I think a secure password is good, but do you really want to shield your little sister from your parents' protection? If she can't remember a good password, do you really think she's cognitively developed enough to discern between someone who wants to be friends and someone who's gonna end up on "To Catch a Predator"? Your ideals of personal freedom don't quite apply the same to someone that young. I would want to know what my child was exposed to. That either means a) only supervised use of the computer, b) some software that prevents things I decide are objectionable from being accessed. Personally, I'm not a fan of using computers/TV as baby sitters, so I'd go with option a. However, if computer use is supervised, what's the point of protecting it from the parents?
Who ever hinted that it was a portal to many nasty things? Maybe all that's on it is her favorite Carmen Sandiego games, and she wants a password so her 9-year-old brother can't play her games, or install his games on her computer? It might not even have an ethernet cable attached to it.
Ownership can be complicated when it comes to siblings, and sibling rivalry. I can totally understand her wanting to have her "space", in a sense, that only she can get to. Didn't you ever have a fort, and only let in friends who knew the secret password, or a lock with a secret combination? It implies ownership and control, and that's an age where you start to understand it and work with it.
There is a giant leap between "kids have a right to privacy" and "kids need to be monitored 24/7." Kids have a right not to be under constant interrogation and inspection by their parents, but not a right to privacy when the parent thinks it's necessary to inspect what the child has been doing. That's just parenting common sense.
So.... You force your child to give up something they want to keep private. If they don't comply, you take away something they like.
And what exactly are you teaching your child? Might makes right? Parents don't respect their own kids? Kids' opinions and feelings don't matter? Powerful people have the right to control less powerful people?
Great lessons, those.
It's much harder to foster respect and open communications. It's called being a parent, not a bully and control freak.
Or it can just be for the same reason that kids like having a "secret hideout" or "secret clubs" or whatever. Like everyone else, they like space --whether physical or conceptual-- that is their own.
Children, even that young, DO need a certain amount of privacy. But that's too young to be having privacy from parents in connection with her interactions with the outside world, and her interactions with the random & anonymous people that she'll meet there.
And being in her own room gives a very dangerous illusion of complete safety-- she would probably want parents present when wandering through a large, bustling crowd of unfamiliar grown-ups, but she's far less likely to recognize any danger when she's alone in her house with her parents in the next room.
If this computer is not connected to the internet, then sure, let her have a password that keeps her parents out of the computer. It's like having a room with a door that closes, or a diary that no one else is allowed to read.
But if it's attached to the Internet? That's another story. Her parents NEED to be involved.
A seven year old with an actually secure computer that not even her parents can gain access to. That's just nuts. And why wait until she can read and write to give her a computer? I can half understand the reading part but writing? She could have been learning to type while learning to write and there is a ton of software for young folks that don't require either skill. Edutainment that uses pictures and colors rather than words. But why lock out the parents? That's pretty troubling.
How is it that one careless match can start a forest fire, but it takes a whole box to start a campfire?
You can't take the sky from me...
You can't take the sky from me...
The parents are, however, legally responsible for the child's actions. As such, it is entirely reasonable for them to have unfettered access to the child's person and effects.
Children don't -get- privacy from their parents, unless the parents should choose to give it to them. A family is not a democracy--it is a dictatorship.
In Xanadu did Kubla Khan
A stately pleasure dome decree
This can be solved by giving the parents the root password and letting the girl keep a secret password. That makes it so that she gets the feeling of privacy and, for the most part, the reality of privacy while still allowing the parents to do and see whatever they want on the computer.
That's a slippery slope. A seven-year-old child should be entitled to the kind of privacy necessary to protect their dignity (in other words, the same privacy to which any human is entitled) and keep them safe. Sending the message that it's acceptable to do things on a computer that the parents won't know about (whether or not that is true) is extending far too much discretion to someone who lacks the maturity to make wise decisions.
A computer is a (potential) gateway into the worlds of people who would knowingly do harm to a child for their own gratification, and children often times lack the experience to know when they are being manipulated into compromising positions.
hell, no wonder so many kids get screwed up and run away at 16.
A family is most definately *not* a dictatorship. It's a family, which has its own dynamic. Respecting the rights of the child (one of those rights is the right to privacy btw.) is fundamental to a healthy functioning family. In turn they should respect your wish to know what they're doing - but not every detail (and you will never find that out anyway).
Responsibility of the parent doesn't make it a dictatorship, legally or otherwise.
I'm shocked that anyone would even think that. A child with no freedom and no room to grow would turn out to be a basket case. I'd wager social services would get involved at some point.
Bullshit.
If you're open about it, then the idea that there is automatic resentment is just bullshit.
If you're open towards them they will react to your actions with equal force in the opposite direction by being just as open towards you.If you make yourself the dictator of the house, however...
You can't take the sky from me...
I totally agree with you here. I have 3 children who use the computer(s) in my house, and I made it VERY clear that they have no reasonable right to expect privacy. I will read their email, read their IMs and view their screen with vnc whenever I feel the need to. I own the computer, I own the networking equipment and pay for the connection(s) to the internet. Just with their cells phones, I own them and can check txt messages, pictures, etc any time I wish. Anytime they feel that their privacy is being violated, I tell them they are free to hand back over the phones and are free to discontinue use of the computers. I have passwords to all their email accounts, both the ones I host on my domain and their yahoo and MSN accounts.
Now, don't get me wrong, i don't monitor every email all the time, nor do I sniff their network traffic all the time. I DO trust them online, they have earned my trust (to get a myspace account, my daughter had to write a 2 page paper on internet stalkers and how to avoid them). However, if I see a change in behavior they don't care to discuss with me, I have EVERY right and the responsibility to find out what's wrong in any way that I need to.
Good judgment comes from experience, and a lot of that comes from bad judgment.
"As a parent, there's no way in a hell a 7 year old will have a lock down to keep mom and dad out, no responsible parent will allow such a thing, and the machine gets taken away if such a practice is put into place."
I did not understand that point of view at 7, and I do not agree with it a 40-something.
It seems to go without saying that children are not entitled to privacy from their parents. I say it is up to the individual parent. Many parents DO respect their children enough to give them privacy. Some consider doing otherwise to be a form of abuse.
-fb Everything not expressly forbidden is now mandatory.
So I guess you're saying I, as a 16 year old, have no right to my 47 character password... (yes, I do actually have a 47 character random password for rare use.)
...ok, maybe you're right. Let the parents install security software, and teach her how to get around it.
I do agree that 7 years old is a bit young for that, but in my case, it's my computer, I paid for it, I can do what I want with it...as is the case here. It's her computer, let her do what she wants. How is she gonna learn anything if the whole system is locked down? I would not be a future computer science major if my parents controlled everything I did on the computer. The main reason I know as much as I do about computers (enough to let me take and easily pass 300 level college courses while still in high school) is from trying to get away from that kind of control.
I'd think that locking them out would be a decent indication for when they're ready to be less supervised--once they can crack the lockout, then it'd be time to sit down and talk about taking it off--and the responsibilities they would have to be aware of. Make 'em sign an AUP at that point, and then you can just keep hold of the root password for when you need to fix something.
In Xanadu did Kubla Khan
A stately pleasure dome decree
If the computer isn't connected to the net (and they aren't able to load inappropriate stuff their friend gave them on a thumb drive), then I don't need access to it. Likewise with a journal. No one ever got kidnapped, raped, and murdered by someone they met by writing in a private journal, and material which the child isn't emotionally and developmentally ready for never spontaneously appeared in it.
Plug it in to the net, or notice little Bobby or Susy loading up stuff on it that you don't recognize from friends, then you bet it's time to want to know what's going on. Kids aren't adults, they don't get the same level of privacy from their parents that adults do, nor should they.
Parents need involvement in their kids lives, it's the way that they shape and mold their kids into functional balanced adults, as well as protect them from dangers the kid doesn't realize exist or doesn't believe in. It's the mark of a good parent, and it's something that's lacking in too many parents.
Slay a dragon... over lunch!
Hah, I don't remember a single point in time I hadn't r00t on all boxes in my home, and I always had at least one computer at home since I was three.
Either you're young enough that you're not a parent (i.e., that "computer when you were 3" was a Windows 95 machine) or you're old enough that the computer you had at home had no real user account control.
TODAY, with the internet everywhere, control of a household computer is as important as control of a household medicine cabinet or control of the family car. You might trust a teenager with it, but if you're stupid enough to trust a seven year old with it you should have your children taken away.
Responsibility of the parent doesn't make it a dictatorship, legally or otherwise.
Of course it does. Did you bother to think this through?
It does not make rational sense to hold someone legally accountable for something they cannot control. If the child breaks the law online, the parent is held legally accountable. Therefore, the parent must have control over what the child does online.
This applies to other aspects of life as well.
Furthermore...from any realistic perspective...freedom requires competence. Children are not "free" to drink alcohol because they are too emotionally and intellectually immature to make wise decisions about alcohol consumption. Their brains are not developed enough, and they do not have enough life experiences yet. They are simply too stupid to know how much is too much. So they don't get any. Once they have grown up a bit that isn't a problem any more, so they become free.
A wise parent won't make the cut off at a specific age, but it is outright obvious that a 7 year old is too immature to roam about unmonitored in an Internet full of predators of every type. Perhaps a 16 year old is. Perhaps that will vary from child to child. In either case the parent is still legally responsible, so the parent is within his/her rights to give as much or as little privacy as he/she deems appropriate.
Let me ask you this....whenever the government tries to pass laws to "protect the children" on the Internet, do you start insisting that keeping kids safe is the parents responsibility? I sure hope so, because it is. People who spout the sort of tripe you are spouting give the government the justification it needs to keep passing these laws...obviously....parents like you aren't doing their job.
Get real.
I agree; that's a parental decision. I wouldn't let my daughter (especially back when she was anywhere near 7 years old) use a computer that I wouldn't have access to.
I'm not saying I would use that access. I'm suggesting that 7 is too young to need it.
Side note--I thought we all agreed 5 years ago that 'boxen' was stupid.
I neither know or care anything about rising children. I will learn if I ever have any. I simply answered the question "why the parents need to be kept out"; since the summary gave me the impression that the it is the child who wants a "parent-proof" PC, I took this question to mean "why would a child want to keep its parents out".
You are seeing moral judgements where there is none, merely an attempt to see the world through someone elses - the kids, in this case - eyes while attempting to solve an interesting problem: how to secure a computer against an attacker who has physical access to both it and the onwer. Since the rest of your post proceeds from this flawed assumption, commenting on it further would be pointless.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Uh ... wait. "Cybernanny" software for high schoolers, yeah, I can see where that's the wrong approach. But what's the problem installing it on a computer for a seven-year-old? There really is a lot of really foul stuff on the Web, and stumbling on it by accident isn't uncommon. Why allow the child's experience to be colored by that?
Breakfast served all day!
I actually admire anyone who can use Linux, especially at age seven! She seems like a genius if she can do that! If the girl is able to maintain her computer and care for it properly, there's no reason for her parents to care what she does. I think she has displayed great presence of mind and is aware of the dangers of the online world. The parents should trust her to use her computer properly. I don't admire authoritarian parents who think they own the kid and everything he/she owns. Yes, they're responsible and have the right to spank if a kid acts up. But how would you feel if someone could read your every email, IM and text message? Would you want that done to you? Parents, please treat your kids the way you would want them to treat you if the positions were reversed, because there will come a time when they will be.
I charge forward recklessly, leaving chaos in my wake.
I've been reading all the posts, and for the most part I agree with the "I wouldn't dream of giving my daughter unfettered access but I think that it needs to be a communication/trust thing." I have 2 daughters, 10 and 12, and for the most part, they do what they want online, and my method of "checking" was to teach them a long time ago, don't hide things, it will only make me more curious what you're up to.... and then when I find something I don't like them seeing, talk to them about it without freaking out on them. so far, it's worked... But there's something haunting me with the way the poster posed his questions that leads me to wonder if the parents are practicing some rather brutal parenting methods. I grew up with a mother who used everything in my life as a cudgel to beat me with -as if growing up a geek wasn't difficult enough! It may be that the brother is simply trying to give his sister some breathing room -though I think the attempt is misguided. If the parenting skills in that house are so bad that he feels he can better educate and protect his sister than his parents can, then child protective services might be more appropriate than a debian box.
While I commend her in being so geeky and security conscious at such a young age, her parents *should* and absolutely, positively *have to* be able to monitor and limit the time she spends on the computer and the activities she can perform there. It is an absolute no-no to allow a kid the use of a computer unsupervised. Find an adequate authentication mechanism (Lunix should have some kind of pictogram thing or graphical thingumabob to allow her in without much head banging on her side and still keep the computer secure while giving her parents full access to the machine to oversee her time on it)
Anyhoo, my 2 cents.
Parents: the internet is not a nanny.
How about getting the kid to play with playdough, building blocks etc. Studies show much more educational benefit for this playing with building blocks than on a computer.
Engineering is the art of compromise.
I can assure you if "older brother" gave "7-year-old sister" a laptop all set up and locked me out with passwords? I'd be sure to take the thing outside in front of both of them and drive over it repeatedly with my soccer mom van. Just to prove a point.
Way to set up a lifelong family schism before she's even 10. They are the parents, older brother. You aren't. And no 7-year-old should have unfettered web access. Are you also going to take the time to explain the fisting video she stumbles upon when she misspells a URL and ends up at the wrong web site?
Of course, I think parents who rely on nanny software instead of their own parenting skills are lazy and clueless. But since older brother obviously feels that he will be a far better parent than his sister currently has, maybe his time would be better off spent actually having a kid of his own and re-evaluating that policy with his own kid.