Slashdot Mirror
Child-Suitable Alternatives To Passwords?
An anonymous reader writes "Two months ago I donated my old PC to my little sister, who is 7 — I had promised she would get her own computer as soon as she can read and write properly. I then proceeded to answer her questions about how it works, as far as she inquired, and tried to let her make some choices when installing Debian (she can already use GNOME). As I explained password protection and encryption to her, I was pleasantly surprised when she insisted on protection measures being as strong as possible, so that no one else can screw with her computer. She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent. The significant problem is that she cannot permanently memorize abstract passwords, even if they are her own creation. I talked with a teacher who assured me that this is common at her age. My parents would probably be able to guess non-abstract passwords. What mechanism of identifying herself does the Slashdot crowd suggest?"
I guess picking the right pictures in a list in the proper order would be a good idea....I think I saw something like that posted on slashdot in the last year.
Would a fingerprint reader be suitable?
Teach her to use passphrases, something like 'My favorite food is steak'. This is something that's easy for her to remember and also hard to break just from the sheer size of the password. When she's old enough, she'll figure out how to make hard passwords on her own; just give her a few suggestions about capitalization, numbers and symbols.
A fingerprint seems like a reasonable idea. If she's just trying to keep other family members off of it, rubber-hose cryptanalysis is unlikely to become a problem, and she's highly unlikely to forget her fingers anywhere.
ttuttle is a rankmaniac
Have her make a pattern on the keyboard that she can remember. I've actually had a number of PIN codes that I didn't actually remember apart from the pattern they make on the numeric keypad.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
Please don't use "umm" or "err" or "erm".
Why on earth should a 7 year old be able maintain privacy on a computer that can serve as a portal to many nasty things?
What doesn't kill you only delays the inevitable
I would suggest the parents have the root password, and their child can ask them to reset her password when she forgets.
Parents guessing the password of a seven year old is ridiculous, is this a serious question ?
Seriously, she's 7?!
I have two daughters around the same age. They share a computer that we gave them for xmas. They have their own accounts, with their own passwords and my wife and I maintain the Administrator account. I could not fathom them having an Internet-accessible computer without us having full control over it.
Am I missing the point ? Because when I read:
"My parents would probably be able to guess non-abstract passwords"
it sounds to me like you're trying to keep a 7 year-old's parents off of a computer she uses when they have every right (and reason / responsibility in this day in age) to know what their young child is doing on a computer.
Of course I am all for teaching kids how to be security conscious and protect their private data. But it's a fine balance. Parents need to keep themselves in the loop in order to, you know, be effective parents.
Have her take a favorite book, start at a random page (or first page if she only needs to keep family members off.) Read the first letter of each page for 10 pages.
On a different topic, you said one thing that shocked me:
She's 7. I don't know how old your younger brother is, but at some age, it is a reasonable thing for a parent to do. It cannot suppliment for parenting, but it can be handy to insist on a website whitelist, or 2-hour cutoff.
Seven-year-olds shouldn't have the full rights of adults.
Your ad here. Ask me how!
With phrases like "She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent" and "My parents would probably be able to guess non-abstract passwords" you are clearly trying to undermine your parents. I know that children, though you don't give your age, usually think that they know better than their parents, but guess what: it isn't usually true! I hope that your parents are smart enough to take your sisters computer away if you succeed in locking them out.
For instance, in high school I listened to Tomorrow Never Knows off of the Revolver record by The Beatles nonstop. Since I know every lyric of that song, I might pick the opening line: Turn off your mind, relax and flow downstream Which would render the password: Toym,rafd Not a bad password, in my opinion. You could do the same with the opening line of a book, quote from a movie, TV show or even a line from a poem. All of these things are very memorable and produce hard to break passwords.
My work here is dung.
That way she has a token that she can easily carry with her (or hide in her room) that will identify her. Bonus points for using a USB key that is brightly coloured or is otherwise aesthetically child-friendly.
Alternatively, consider fingerprints - this may actually have quite poor security, but in this case it's probably good enough. And the privacy issues don't apply in this case (she _wants_ the security and her fingerprint will only be stored on her own PC). The other known problem is that some people don't have usable prints, but this is something you can check.
...like, "My parents are responsible for me." Or, "I live under their roof, so I play by their rules." Or, "My brother is an asshat."
And yes, I'm a parent.
I think that this case might be a little silly because the parents should have root/Administrator access and the child should have a user account, but there is a real question here: how can someone who isn't able remember a password identify themselves to a computer? For example, in a situation where all of the students at an elementary school have individual accounts. First graders cannot be expected to remember a password, but they do have an expectation of privacy. Or maybe the case of someone who has had a traumatic brain injury and suffers from severe memory loss. Despite the framing, the core question I think still stands.
So basically you want to subvert the ability of your parents' to exert their moral and legal responsibility to raise their daughter by allowing a 7 year old child, one who is not capable of something so requisite as remembering a significantly complex password? Your little sister has no business having unfettered access and control over her computer, and consequently, her online experience. You are irresponsible, probably due to considerably immaturity, and should refrain from interferring with your parents' raising their daughter.
Democrats and Republicans are like AIDS and Cancer, I want neither!
What parental control software IS there for Debian?
one of the main reasons I haven't switched to Linux is the (at least percieved) lack of parental control software...
I would say the majority of non-computer users have trouble remembering really strong passwords (ones that make use of a mixture of letters and numbers and punctuation marks). I find the solution is to rely on muscle memory.
Pick a column on the keyboard and press every key along that line. For example 4rfv. Now hold down the shift key and repeat it. $RFV. So the password is 4rfv$RFV which is relatively strong for most uses but is a snap and simple to remember.
The only caveat is that it's not a password that you can type while someone is watching but then...really nobody should be watching when you type any password. Although, pressing the shift key can be pretty subtle.
Other patterns like squares or crosses work as well.
- JoeShmoe
.
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Something like 3ed4rf5tg (try typing it) or sxdcfvgb should do the trick. Starting with the first letter of her name might help.
Thanks for your password, I've taken the liberty of moving all the money for your bank accounts to mine.
Holy mother of God - what, besides WebKinz do you think your daughter is likely to be up to? And if your Linux box won't run that and Bild-a-Bear properly then she won't like it anyhow.
She's seven years old! Let her pick a password that's easy for her to recall. The important thing is that she's accustomed to passwords etc, not that she understands cryptographic science.
Three Squirrels
"...I was pleasantly surprised when she insisted on protection measures being as strong as possible, so that no one else can screw with her computer. She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent."
This has me a little baffled, but probably for lack of context. I'll assume that formal legal gaurdians or parents are the agents initiating the installation of the parental control software. If not, ignore the rest.
The concern seems to be that a 7 year old girl should be able to successfully thwart any attempt to protect her by the "screwing" of her computer in spite of what might be a legitimate act by those charged with her care to protect her as a child. If she were 18 (maybe even 16), that's one thing, but taking direct action to eliminate protective policies over a young child from someone who is clearly not the parent or guardian steps over a number of lines, both legal and ethical.
Whether or not you agree with "strict" policies that govern a child that is not your own, it just isn't your decision to make. The fact that it is a computer makes no relevant difference.
Maybe the conversation would more appropriately be with those that are liable and charged with her care rather than trying to subvert it.
All you need is the following.
A seporate USB Keyboard a numberpad extenstion can work
A Lathe.
A Wooden Dowle.
A wooden box or sheet metal.
A drill with a bit the same size as the dowel.
Ok take apart the USB Number Pad rewire it so all the keys are in a straight line.
Take the woden dowle on the lathe and cut impressions for all the keys.
Cut out different sections from the lathed dowle so when spun over they keyboard it presses the keys in a unique fassion. Put the modified keyboard in the box and drill a hole in it just above the keyboard for her to put the Dowle key in. and hook it up to the computer. And have her keep the key. That whay when it asks for a password she just needs to put the key in and turn it. And it will type the password.
This may sound a bit extream but the instructions are easer then say getting Ubentu to Run in Parallels.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Quit posting crap articles like this...this is obviously about a 14 year old boy that thinks his sister needs security from his clueless parents.
PAM USB auth.. Then you can take the smallest USB flashdrive you can find. Then build it into something fluffy and big.
Casual discovery by accident with out further access is completely different from the volumes and types of smut available online. I've got no problem with the girl having an account and a password, but the idea of my daughter having access to the internet without me being able to monitor what she does scares the crap out of me. I didn't tell my parents anything but when they got concerned they were able to toss my room and find anything they didn't think I was mature enough for. It's much harder to toss a computer account that you don't have the password for. It's akin to giving you 7 year old a solid door and deadbolt system to their room without keeping a copy of the key for your self. It's just plain stupid.
Bureaucracy expands to meet the needs of the expanding bureaucracy.-Oscar Wilde
But then still, a child may need privacy, but the parents need to have a way to access it. Whether they should do it or not, that is another discussion. You are talking about a seven-year-old here. They need parental supervision, and a certain degree of control. Clear limits within where to operate. Keeping things secret as a child from their parents is one thing; completely undermining parents' controls is another. And with that I am not talking about the software based "parental controls".
Surely as the computer in question will be exposed to the internet, a decent password is required. But why all the effort of keeping everything inaccessible to the parents? That is going too far.
Shear fact? This is a password for a computer, not a pair of scissors...
Oh, I get it! Your spelling mistakes are a form of security! If you don't have the exact right level of literacy, your computer won't let you post. Ho ho, very clever!
I like to place meaningful quotes in my sig, so people will know that I know what meaningful quotes are.
You need to stay the hell out of your parent's business.
When you have a 7-year-old, feel free to lock yourself out of their PC.
I have a seven-year-old child who needs to drive around town in a car, but has problems getting the keys. Is there anyone on Slashdot who has suggestions on how to open, start, and operate a car without keys and otherwise make it so easy even a seven-year-old can do it? Thanks! Signed, A Responsible Human Being
"provides a simple solution we ordinarily remember? done!"
I think a secure password is good, but do you really want to shield your little sister from your parents' protection? If she can't remember a good password, do you really think she's cognitively developed enough to discern between someone who wants to be friends and someone who's gonna end up on "To Catch a Predator"? Your ideals of personal freedom don't quite apply the same to someone that young. I would want to know what my child was exposed to. That either means a) only supervised use of the computer, b) some software that prevents things I decide are objectionable from being accessed. Personally, I'm not a fan of using computers/TV as baby sitters, so I'd go with option a. However, if computer use is supervised, what's the point of protecting it from the parents?
Who ever hinted that it was a portal to many nasty things? Maybe all that's on it is her favorite Carmen Sandiego games, and she wants a password so her 9-year-old brother can't play her games, or install his games on her computer? It might not even have an ethernet cable attached to it.
Ownership can be complicated when it comes to siblings, and sibling rivalry. I can totally understand her wanting to have her "space", in a sense, that only she can get to. Didn't you ever have a fort, and only let in friends who knew the secret password, or a lock with a secret combination? It implies ownership and control, and that's an age where you start to understand it and work with it.
A seven year old with an actually secure computer that not even her parents can gain access to. That's just nuts. And why wait until she can read and write to give her a computer? I can half understand the reading part but writing? She could have been learning to type while learning to write and there is a ton of software for young folks that don't require either skill. Edutainment that uses pictures and colors rather than words. But why lock out the parents? That's pretty troubling.
How is it that one careless match can start a forest fire, but it takes a whole box to start a campfire?
You can't take the sky from me...
I was shocked a number of years ago when I was moving some furniture so the floors could get cleaned behind the beds. There, under my (then) five year old's mattress, was a complete list of all of my (and my wife's) passwords. He had everything (from multiple machines): power-on passwords, logon passwords, email account passwords, merchant passwords--even our online banking passwords!
[No, they were not all the same. Some of them were quite complex, too, like 'ni*45FPN!ng'. I got to play "change-the-password" for a few hours that evening.]
I asked him how he got them: he shoulder-surfed us for every one of them. The reason he had them? He wanted to sneak down to the computer at 3 in the morning and play Spooky Castle.
That scared the snot out of me. Now, I know he may not be the typical kid, but it just goes to show that you really can't be too careful with your passwords.
As to the boy, I started encouraging him to use his powers for good. I teach network administration at an area college, so I started bringing him with when I had to configure the lab. He caught on quick, and was a huge help. He's just over 11 now, and while he's still one of the most tech savvy kids in the house, he has little interest in PCs (that might be a good thing). He'd rather spend time outdoors (even when it's thirty below zero) or with his pet cockatiel.
I use irony whenever I can, but my shirts are still wrinkled...
Who said anything about the internet? He only said it's a box running Debian... it might not even have an ethernet cable attached to it. Maybe she just wants to keep her Carmen Sandiego games protected from everybody else.
I mentioned it in an earlier post that this is an age where children are learning about control and ownership - secret passwords to let people into their "fort", a lockbox for their "precious jewels" with a key that only they have... sibling rivalry can be a big deal, and kids need their space, whether it's a room or a computer.
You can't take the sky from me...
Bullshit.
If you're open about it, then the idea that there is automatic resentment is just bullshit.
If you're open towards them they will react to your actions with equal force in the opposite direction by being just as open towards you.If you make yourself the dictator of the house, however...
You can't take the sky from me...
Hey, it was good enough to prevent you from replying using his account, at least.
Abuse is the one area a child does need help overstepping their parents. However, if the child is being abused, you should be going to the authorities or someone who can help with that. If the parents are looking out to protect her, which it sounds like that's maybe the case, then they should know what a 7 year old is doing. I noticed a point of if the computer isn't connected to the network then maybe there less need for protection but if there's no abuse and she's still under her parent's authority, what is the problem?
Why use 'password' when you can just use '12345' coincidentally that's the same combination i have on my luggage.
If i had one dollar for every brain you dont have, i would have $1.
I've been reading all the posts, and for the most part I agree with the "I wouldn't dream of giving my daughter unfettered access but I think that it needs to be a communication/trust thing." I have 2 daughters, 10 and 12, and for the most part, they do what they want online, and my method of "checking" was to teach them a long time ago, don't hide things, it will only make me more curious what you're up to.... and then when I find something I don't like them seeing, talk to them about it without freaking out on them. so far, it's worked... But there's something haunting me with the way the poster posed his questions that leads me to wonder if the parents are practicing some rather brutal parenting methods. I grew up with a mother who used everything in my life as a cudgel to beat me with -as if growing up a geek wasn't difficult enough! It may be that the brother is simply trying to give his sister some breathing room -though I think the attempt is misguided. If the parenting skills in that house are so bad that he feels he can better educate and protect his sister than his parents can, then child protective services might be more appropriate than a debian box.
I have two solutions if your little ones are paranoid about being spied on. Either give them a knoppix disk and a thumbdrive to keep all their important files with them at all times, or give them total control over their machine...
Like: http://www.achatz.nl/catalog/product_info.php?cPath=3&products_id=38
It might not be the best and fastest, but its damn good... Give it enough time, code, and wire, your girl could do most anything.... Build a chip for sd cards for storage... Figuring some way to connect to the world wide web.... It'll be like getting a UGO into the grand prix and winning... And in this case, less is more... You still need to spell, and the most of the memory included is in the users brain... Nothing like building your own machine to give a sense of accomplishment...
3 degrees of separation from Vladimir Putin
While I commend her in being so geeky and security conscious at such a young age, her parents *should* and absolutely, positively *have to* be able to monitor and limit the time she spends on the computer and the activities she can perform there. It is an absolute no-no to allow a kid the use of a computer unsupervised. Find an adequate authentication mechanism (Lunix should have some kind of pictogram thing or graphical thingumabob to allow her in without much head banging on her side and still keep the computer secure while giving her parents full access to the machine to oversee her time on it)
Anyhoo, my 2 cents.
Parents: the internet is not a nanny.
How about getting the kid to play with playdough, building blocks etc. Studies show much more educational benefit for this playing with building blocks than on a computer.
Engineering is the art of compromise.
I can assure you if "older brother" gave "7-year-old sister" a laptop all set up and locked me out with passwords? I'd be sure to take the thing outside in front of both of them and drive over it repeatedly with my soccer mom van. Just to prove a point.
Way to set up a lifelong family schism before she's even 10. They are the parents, older brother. You aren't. And no 7-year-old should have unfettered web access. Are you also going to take the time to explain the fisting video she stumbles upon when she misspells a URL and ends up at the wrong web site?
Of course, I think parents who rely on nanny software instead of their own parenting skills are lazy and clueless. But since older brother obviously feels that he will be a far better parent than his sister currently has, maybe his time would be better off spent actually having a kid of his own and re-evaluating that policy with his own kid.