Slashdot Mirror
Map Based Passwords
smitty777 writes "Discovery is running an article on passwords based on a very specific location on a map. Instead of showing UID and Password fields, the user would simply click on a very specific spot on Google Earth, for example. I wonder how you would make that secure? Also, if you forgot, would you get a message saying 'Your password is the third flamingo on the left on the lawn of Aunt Bessie's house'?"
... and when the internet link is down or God forbid, Google Earth is down, users login how?
I forgot my gmail password
and here was my hint.
(how I forgot "goatse" as a password is beyond me.)
Trolling is a art,
...this one is easy enough to crack just by shoulder-looking. And of course there's the issue of needing to load a ton of map data just for a simple password entry, and if the map provider is out you're screwed. Plus the hassle of zooming down from a world-map to some specific point every time you want to get into a site. Need I go on?
Here is the US that would be very effective.
REQUEST: Locate Belgium on a map
RESPONSE: uh.....uh......connection timed out!
Flexible bare-metal recovery for Linux/UNIX
MEMO FROM IT DEPT.
It has come to our attention that some users are selecting weak passwords. Henceforth, we have implemented measures to prevent selecting passwords based on well-known locations, major cities and major landmarks. When selecting a password we will not allow you to use a place that you, a relative or a friend have ever lived or visited. Please fill out the attached questionairre listing everywhere you have been since you were born.
Thank you.
IT - Department - help you can count on
Intron: the portion of DNA which expresses nothing useful.
something tells me you don't need to worry about women.
That's amazing! I've got the same flamingo on my luggage.
Could you use the scalability of fractal images as a map in this manner?
By my understanding, this would give you random numbers depending on your "depth" and x/y coordinates.
I prefer the one we put on all the windows machines here at work.
"your password must not contain any characters that can be typed on the keyboard."
The CTO did not think that it was funny...
Do not look at laser with remaining good eye.
Dang, my password was someone's backyard where they had spelled out "GOD" "SEX" and "LOVE" with their hedges. If I ask them to grow a "1" after it will we be all good?
It's not half as dumb as the summary makes it sound.
For security, what matters is the keyspace and the likelyhood of guessing correctly. The keyspace easily competes with alphanumeric passwords. It is dramatically reduced by the assumption that people will pick places with meaning to them, which means places they've been to. Nevertheless, it should measure up to passwords in security.
Different from passwords, though, the human mind is pretty well equipped to recall specific places. Arbitrary alphanumeric combinations, on the other hand, are amongst the most difficult things to remember and recall.
Assorted stuff I do sometimes: Lemuria.org
They pull over and ask a gas station attendant what their password is.
Support Right To Repair Legislation.
Looking at Google Maps the area covered by the windshield of my car is about five places after the decimal point of precision in both lat and long. That is about one square meter and as precise as you could realistically expect users to be. That would mean each location would give you 2+5 digits for the lat and the long, a total of 14 digits for a password. That's 10^14 possibilities. For comparison a password made up of random characters (lower, upper, digits, special) for a total of 95 total possible choices would need to be seven characters long to have about the same entropy (67 trillion vs 100 trillion).
Seven character random passwords are ok, but certainly not uncrackable. You could argue that letting the user choice several spots would greatly increase the entropy, but realistically the user is going to pick spots close together. Not to mention you could probably cut down on the possible locations with something similar to a dictionary attack, i.e., eliminating the vast expanses of nothingness that are unlikely to be chosen (like oceans, and deserts). Lastly, it relies too heavily on the mapping service. What happens when they update their images and your landmark disappears or moves slightly?