Slashdot Mirror
The Problem With Windows 8's Picture Password
alphadogg writes "The Windows 8 feature that logs users in if they touch certain points in a photo in the right order might be fun, but it's not very good security, according to the inventor of RSA's SecurID token. 'It's cute,' says Kenneth Weiss, who now runs a three-factor authentication business called Universal Secure Registry. 'I don't think it's serious security.' The major downside of the picture password is that drawing a finger across a photo on a touch screen is easy to video record from a distance — making it relatively easy to compromise, he says."
Just look at the greasy finger marks
Surely an accomplished individual like him could put out a serious paper on why picture passwords aren't good security, if they aren't. The math seemed alright in the Microsoft blog, so I don't know what the problem is.
Oh, I know what it is, he's the head of a company that offers alternative security products that use multi-factor authentication. *Of course* well implemented multi-factor auth is more secure than single-factor, but if he weren't in charge of a company trying to sell a product, would this article even exist? Probably not.
The lock on your diary offers little protection from a skilled locksmith most can be opened with a simple bent piece of metal.
If you have someone following you around with cameras trying to capture your login info to use later when they have physical access to your machine a traditional password probably isn’t going to cut it either. This provides the same kind of “guy walking by” protection as traditional passwords do. Ok, maybe less.. but still. Maybe this will actually push people towards more secure auth for serious things by highlighting how insecure a basic password is.
All that said, I think it’s a pretty stupid feature ;p
Of course it's not "very good" security. Neither is Android's face unlock. Neither are PINs. Neither are passwords. etc. etc. etc.
The whole point of things like this are that they're better than no security and that people will actually use them. You can have the best security setup in the world, but if users never enable it because it's too much of a pain in the ass, then it's worthless.
I could unlock my friend's Android phone just by studying the smudge patterns on the touchscreen. I imagine this would be just as easy.
Then you can use the actual password on the on-screen keyboard. The picture password is just an optional convenience feature.
Hence, RSA tokens + passwords (something you have + something you know)
Smart cards + biometrics (not perfect, but something you have + something you are)
Or even all three, for the truly paraniod (smart card + biometric scan + password)
Even with all three, a sufficiently determined entity with sufficient resources can overcome it. Video recording + physical acquisition of the owned object + physical acquisition of the biometric object (hope it's just a fingerprint scan and not a retinal scan!) will get an intruder past the security trifecta.
What next, DNA + mind scan + a password > 512 bytes?
Here are the links to the relevant Microsoft blog posts:
http://blogs.msdn.com/b/b8/archive/2011/12/16/signing-in-with-a-picture-password.aspx
http://blogs.msdn.com/b/b8/archive/2011/12/19/optimizing-picture-password-security.aspx
For only $99.95, you can buy our three factor authentication software for one year! That's right, keep criminals from stealing your digital camera pictures of your cat for a nominal fee! I'm willing to bet this picture security is no less secure than typing on a keyboard that's visible on the screen and combining it with the screen smudges. Domains probably won't use this authentication anyway, or at least it'll be optional.
So QUERTY becomes "Head, Shoulders, Knees and Toes". I'm guessing in many cases that the picture itself would suggest how it was to be interacted with.
The WILL forget their password. We have laptops here with fingerprint scanners. Everyone who uses the scanner (optional) has forgotten their password.
If I were God, wouldn't I protect my churches from acts of me?
"Good" is in this case equivocal. Are picture passwords highly secure? Probably not. SO they aren't very good in that sense. Are they easy to use and secure enough for most purposes? Yes, making them extremely good for the average user. Which makes them better security in many ways than multi-factor authentication, which would be absurd for a tablet device that isn't carrying top-secret documents. As people have pointed out many times, complex security often ends up being less secure, as the user has to find ways of remembering long passwords, gets sick of the wasted time and just used "1234" for the both of the redundant passwords, or just turns off the security as soon as they can or ignores it entirely (Windows UAC under Vista).
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Has he even tried this? I can't reliably login using the picture password setting, and I'm the one that set up the "password". I'm not convinced a video recording would suffice. I could, just as easily, video record your keyboard from a distance, but that's not going to net you my password very reliably either. Not unless you're a chicken pecker.
Joseph Elwell.
You remember the passwords of the old days that your users had? That were the names of their loved ones, their birthday or the ever popular "test", "password" and "12345"?
Guess what, they'll get a revival. For the same damn reason: People have no idea about security and they don't give a fuck about it. They prefer easy to remember passwords to secure ones. Just that with picture passwords, unlike standard typed ones, it's kinda hard to implement password security standards.
Why it's more insecure than typed passwords? Well, take your average photo. Now imagine what 4 points a person might be touching in it. Can you spot more than 6 "sensible" spots? People will choose points in the picture that stand out, and there won't be many more than 4-6 points that stand out. Unless some kind of 3-strikes-rule gets implemented (not bloody likely on a private computer, or even corporate computers after helpdesk had to reset the password for the n-th time because people failed to hit the right spot on their picture), it just takes rather few attempts at "connect-the-dots" before you find one that fits.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How the hell do you typo QWERTY?
The interesting thing to me is that on a photo there would be obvious "points of interest". If you had a picture of a few friends, you would likely use their faces as touch points. If you had a picture of a hillside with some houses, those would likely be the points that get touched. Don't get me wrong, I like the idea of this rather novel password concept, but I think that in terms of security (at least for the most part) that any photo would have obvious points that narrow down the possibilities.
Moved to http://soylentnews.org/. You are invited to join us too!
If you had a picture of a few friends, you would likely use their boobs as touch points. FTFY
To be fair he *is* an expert in poor security.
- Hey, give it back your bastard! Eh, at least he is not going to get any of my secret data - it is fingerprint protected! ... Leave me at least left hand, pleeaseee!
- What are you doing with this knife?! Aaaaaaaargh...
- You sick fuck! And what makes you so sure I use right index finger anyway? No, wait, this was just a joke!
- Omg, he has an axe too
- Well, I can't use fingerprint scanner anymore so I will get a laptop with iris scanner. What could go wrong?
I do not use a QWERTY keyboard, you insensitive clod!
Score: i, Imaginary
How the hell do you typo QWERTY?
Good question and thank you kind AC for pointing it out. I guess it happened because my fingers don't willingly type misspelled words and I type 'query' about a million times more often than I type qwerty.
The "things" that matter the most to me, my most valuable "things", are protected by a flimsy wooden door with easily breakable hinges and easily pickable locks - my wife and kids. I would think if you apply your logic, then unless your wife and kids were locked up in a vault in, say, fort knox, you would consider it unsecure?
My point being that it's a risk/reward thing. If you have something on your tablet that needs 3 factor authentication, you would have 3 factor authentication. But not everything needs 3 factor authentication. I don't need to lock up my family in fort knox. Just like I don't need what I have on my tablet to be protected by a 3 factor auth.
That could work if you had pictures with multiple objects. Something like cat-ball-car ... But you would need some crowd sourcing to generate the data. Or use something like Settlers of Cattan pieces, or Magic the Gathering cards. Click 3 roads or 5 mana symbols.
Bonus points if you built a modular system.. So people can make their own image packs... Allowing for more "inside jokes".
Wouldn't it be prudent for the inventor of "RSA's SecurID token" to say that basically any security system other than his is ineffective?
But if the security image is a photo with 2 people and a dog, against a white wall it's pretty likely that I can guess where the taps are, so I only have to guess the order.
In that case... don't choose an photo of 2 people and a dog.
What you're saying is "This system has very poor security, if they choose the pictures poorly and each picture has very few probable combinations". Pretty obvious answer is: Don't choose such pictures. I'd guess that before they choose a picture for this purpose, they do some testing on what kind of patterns people use and discard the pictures where there is too little distribution. Of course, users may always use the most obvious pattern and they might be able to choose a picture themselves and use too simple picture... but users can also choose very stupid passwords.
That's my point exactly - in the lab, I'm sure this is a very secure system and can be made to be much more secure than a traditional passphrase. But in the real world, people see security as something that gets in the way, so they choose something easy to use, not something secure, so this ends up being not any more secure than any other system.
All of these would help secure picture passwords and protect against snoopers.
MS addressed the insecure picture idea in one of their blog posts. It's insecure if you have only one or two points of interest, but with 3 or more the security goes up quite a bit because each of the POI's has numerous things that can be attributed to them - taps, swipes from one to another in either direction and different sizes of circles. Then you have to get the order right on top of that. Yes, there are other issues for sure (Smudges, etc.) but the points of interest one isn't actually that bad.
+1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill