Slashdot Mirror
Let Your Theme Song be Your Password
An anonymous reader writes "The latest proposed solution to the fact humans suck at using passwords properly is to let people use digital objects, like mp3s, photos or videos instead. A file is hashed into a unique, secure string that acts as the real password. A paper on the idea was put forward in a recent Usenix conference on hot topics in security, and a Firefox extension that implements the idea is available too."
"Your honor, the defendant has a musical password which was not authorized by us! By using it on more than one computer, he has distributed it illegally. We demand $700,000 in damages."
setting next to bums, there's an open seat, hope that isn't pee
Hmm, I wouldn't want to be the sysadmin to recover a lost goatse "password picture"!
goatse?
Damn! I have the same combination on my luggage!
I think I'll use Sting's "Let Your Soul be Your Pilot", with slightly altered lyrics.
Escher was the first MC and Giger invented the HR department.
I have a fingerprint scanner on my computer which uses libpam-thinkfinger (IIRC) to log me into my desktop session. You'd think the complexity was all the possible permutations of the lines and ridges on my finger, but really, it's just 1 in 10.
Well, it used to be 1 in 11, but I had that fixed. :-)
Really? I used to use the tip of my penis, but MAN you should have heard the other people in the building COMPLAIN. Bitch, Bitch, Bitch.
Something tells me a significant portion of the people who'll ever use this will pick "White and Nerdy" by Weird Al' as their theme song... which would kind of invalidate the whole system :>
No, but I did throw granola at a deaf person once
Much more secure, and easier, is just to remember a few words from the theme song, and craft them into a password, substituting numbers as appropriate. There are many more variants this way, and you don't have to modify the password programs.
Then you work through the song, verse by verse.
As an example, I change my Slashdot password once a month to keep it secure. I'm in the middle of "Money ain't for nuthin", and my current password is based on "Custom Kitchens": two days ago, I modified it to be "ku5t0mK". In about another three weeks, I'll modify it to something based on "refrigerators". Each time I update my password, I have no problem remembering it; and there's almost zero chance that anyone will hack my Slashdot account.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
image of you doing something unlikely
No need to be coy here, you can just say "sex".
No trees were harmed in the posting of this message. However, a great number of electrons were terribly inconvenienced.
I'll just use "Never gonna give you up" by Rick Astley. I'm sure everyone's forgotten that song by now, right?
Who needs last.fm? A dictionary attack involving every song released by the RIAA in the last decade would run into (at a wild guess) a few million. Hashing those into a dictionary would take a few days or perhaps weeks, and once done, would not have to be done again. My bet would be on about a month before the first distributions of song hash tables by a bunch of bored kids who know how to use md5sum and bash scripting.
So dictionary attacks with a few million possibilities? This "security" development is worse than the use of real, un-obfuscated dictionary words.
A few MILLION???? Havent you heard all the music lately, it all sounds the same... take a hash of one Britney Spears song and you just got them all... and NO, I will _not_ leave Britney alone.
What was that Jiminy-Cricket??
"Let Your Theme Song be Your Password, and Always Let Your Conscience Be Your Guide"
How amazed would you be to suddenly find that you just forgot what I wrote and you needed to reread my post.... again.
Half the nerds and geeks I know would have the same sound as their login sound. The Imperial march from Starwars (vader's theme).
I am worried about Bob being a bigger fan of Britney Spears than Alice who used to use "br1tney" as her password... Seriously, there's something VERY wrong with Bob.
On the plus side, no one wants to borrow your computer.
Beta sux! Join the Slashcott! http://hardware.slashdot.org/comments.pl?sid=4760465&cid=46173047