Slashdot Mirror
The Problem With Windows 8's Picture Password
alphadogg writes "The Windows 8 feature that logs users in if they touch certain points in a photo in the right order might be fun, but it's not very good security, according to the inventor of RSA's SecurID token. 'It's cute,' says Kenneth Weiss, who now runs a three-factor authentication business called Universal Secure Registry. 'I don't think it's serious security.' The major downside of the picture password is that drawing a finger across a photo on a touch screen is easy to video record from a distance — making it relatively easy to compromise, he says."
Surely an accomplished individual like him could put out a serious paper on why picture passwords aren't good security, if they aren't. The math seemed alright in the Microsoft blog, so I don't know what the problem is.
Oh, I know what it is, he's the head of a company that offers alternative security products that use multi-factor authentication. *Of course* well implemented multi-factor auth is more secure than single-factor, but if he weren't in charge of a company trying to sell a product, would this article even exist? Probably not.
The lock on your diary offers little protection from a skilled locksmith most can be opened with a simple bent piece of metal.
If you have someone following you around with cameras trying to capture your login info to use later when they have physical access to your machine a traditional password probably isn’t going to cut it either. This provides the same kind of “guy walking by” protection as traditional passwords do. Ok, maybe less.. but still. Maybe this will actually push people towards more secure auth for serious things by highlighting how insecure a basic password is.
All that said, I think it’s a pretty stupid feature ;p
Of course it's not "very good" security. Neither is Android's face unlock. Neither are PINs. Neither are passwords. etc. etc. etc.
The whole point of things like this are that they're better than no security and that people will actually use them. You can have the best security setup in the world, but if users never enable it because it's too much of a pain in the ass, then it's worthless.
I could unlock my friend's Android phone just by studying the smudge patterns on the touchscreen. I imagine this would be just as easy.
Even in the worst-case scenario where the computer was used for nothing but logging in with the picture password, the math works out that it's still more reliable than the 4-digit pin that many other devices use.
Hence, RSA tokens + passwords (something you have + something you know)
Smart cards + biometrics (not perfect, but something you have + something you are)
Or even all three, for the truly paraniod (smart card + biometric scan + password)
Even with all three, a sufficiently determined entity with sufficient resources can overcome it. Video recording + physical acquisition of the owned object + physical acquisition of the biometric object (hope it's just a fingerprint scan and not a retinal scan!) will get an intruder past the security trifecta.
What next, DNA + mind scan + a password > 512 bytes?
The interesting thing to me is that on a photo there would be obvious "points of interest". If you had a picture of a few friends, you would likely use their faces as touch points. If you had a picture of a hillside with some houses, those would likely be the points that get touched. Don't get me wrong, I like the idea of this rather novel password concept, but I think that in terms of security (at least for the most part) that any photo would have obvious points that narrow down the possibilities.
Moved to http://soylentnews.org/. You are invited to join us too!
- Hey, give it back your bastard! Eh, at least he is not going to get any of my secret data - it is fingerprint protected! ... Leave me at least left hand, pleeaseee!
- What are you doing with this knife?! Aaaaaaaargh...
- You sick fuck! And what makes you so sure I use right index finger anyway? No, wait, this was just a joke!
- Omg, he has an axe too
- Well, I can't use fingerprint scanner anymore so I will get a laptop with iris scanner. What could go wrong?
Its not about the probability of other fingerprints on the device - all you need is a fairly good idea of where someone has been tapping on a photo, and from the photo you will probably be able to guess which points they've used.
As someone who has owned several touch-screen devices over the last decade, I've noticed that it's a common occurrence for the oil on fingers to accumulate in a tell-tale trail on the screen if you're often swiping a particular pattern. It's the primary reason I switched to a numeric pin rather than the pattern-based authentication on my Android phone. Doesn't seem to happen with taps as it does with swiping.
Just look at the greasy finger marks
You know, the OS could mitigate this quite easily by moving around the picture, reorienting or rotating it. This would eliminate the benefit of muscle-memory, but allow it to be more secure.
Make sure everyone's vote counts: Verified Voting
Yeah, you can do that on a computer with a REAL screen, not those little iToys that all the cool kids have to carry around with them these days.
Can't wait for this fad to die down a bit so we can quit hearing all these retarded stories about "The Desktop Computer is DOOOOOOMMMEEEDD!" all the time.
Sure, it's eventually doomed, but not for a long time still. There are so many things that I do on a triple headed desktop that I would never want to attempt on a mobile or pad. (Coding, taxes, etc.) And some things are more convenient on a mobile device. (Driving directions, reading the news over lunch, etc.)
CricKet MessageMate II WTF! ;)
Wouldn't it be prudent for the inventor of "RSA's SecurID token" to say that basically any security system other than his is ineffective?
But if the security image is a photo with 2 people and a dog, against a white wall it's pretty likely that I can guess where the taps are, so I only have to guess the order.
In that case... don't choose an photo of 2 people and a dog.
What you're saying is "This system has very poor security, if they choose the pictures poorly and each picture has very few probable combinations". Pretty obvious answer is: Don't choose such pictures. I'd guess that before they choose a picture for this purpose, they do some testing on what kind of patterns people use and discard the pictures where there is too little distribution. Of course, users may always use the most obvious pattern and they might be able to choose a picture themselves and use too simple picture... but users can also choose very stupid passwords.
That's my point exactly - in the lab, I'm sure this is a very secure system and can be made to be much more secure than a traditional passphrase. But in the real world, people see security as something that gets in the way, so they choose something easy to use, not something secure, so this ends up being not any more secure than any other system.