Slashdot Mirror
Unbreakable Crypto: Store a 30-character Password In Your Subconscious Mind
MrSeb writes "A cross-disciplinary team of US neuroscientists and cryptographers have developed a password/passkey system that removes the weakest link in any security system: the human user. It's ingenious: The system still requires that you enter a password, but at no point do you actually remember the password, meaning it can't be written down and it can't be obtained via coercion or torture — i.e. rubber-hose cryptanalysis. The system, devised by Hristo Bojinov of Stanford University and friends from Northwestern and SRI, relies on implicit learning, a process by which you absorb new information — but you're completely unaware that you've actually learned anything; a bit like learning to ride a bike. The process of learning the password (or cryptographic key) involves the use of a specially crafted computer game that, funnily enough, resembles Guitar Hero. Their experimental results suggest that, after a 45 minute learning session, the 30-letter password is firmly implanted in your subconscious brain. Authentication requires that you play a round of the game — but this time, your 30-letter sequence is interspersed with other random 30-letter sequences. To pass authentication, you must reliably perform better on your sequence. Even after two weeks, it seems you are still able to recall this sequence."
How many standard deviations above 'random guessing' are we talking about? Over how many trials? And 2 weeks is fine, but what about 6 months to a year?
I still prefer 80+ character passphrases lifted from song lyrics whenever possible. If you know the song well enough it's impossible to crack, and the search space is still large among people who know you like that particular song
Replace 'character' with 'note' and it's clear subjects were tortured with Philip Glass for 80 hours and won't soon forget.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
State Security forces you to play this game?
The "cross-disciplinary team of US neuroscientists" came up with the most original excuse ever for why they were spending all their grant money on games consoles and all their time playing games.
Log in or else!
It sounds like the way this works, the server will need to know what the password is in order to produce the combined sequence. Doesn't that make it weaker than ordinary passwords? And if you repeatedly get the same random sequence, over time you'll learn that as well. OTOH if you get different random sequences, then it would be possible to extract the original sequence. Did I miss something here?
Do you care about the security of your wireless mouse?
Their experimental results suggest that, after a 45 minute learning session, the 30-letter password is firmly implanted in your subconscious brain. Authentication requires that you play a round of the game
I'm assuming I'll still be automatically logged out after 5 minutes of inactivity, cannot recover but will have to change my password when forgotten and passwords will expire every month?
Also; the research suggests users will have to perform better on the injected "password" sequences than random sequences... how will they deal with top players that get a perfect score every time for the entire sequence?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
up-up-down-down-left-right-left-right-B-A-start
I'd rather have someone respond than be modded up.
Only 38 bits of entropy because there's only 6 choices for each of the 30 characters. Yeah a Tesla GPU can chew through that in a day. I'd post the relevant XKCD comic but I'm pretty sure everyone here knows what it is already.
The system requires that you copy-write a short random message by hand, but at no point do you actually remember the subtleties of your individual writing style, like the ballpoint pressure or distribution of the shape of "o"s, meaning it can't be presented as a plain sequence of letters and it can't be obtained via coercion or torture i.e. rubber-hose cryptanalysis. The system, devised by Anonymous Coward, relies on implicit learning, a process by which you absorb new information, but you're completely unaware that you've actually learned anything; a bit like learning to ride a bike. The process of learning the password (or cryptographic key) does NOT involve anything, as your writing style is likely already precisely and intricately shaped for years.
Without a human specialist, a dedicated OCR software would need to be developed, though...
How does the scheme prevent ``play this game or I'll kill your family''?
Passwords are clearly a very bad idea - they just don't work for any number of logical, social and practical reasons. So it's great to see real thought going into alternatives. Although I think the overhead of 45 mins learning and other issues with this are a problem, I think the general premise must have something in it that would work well.
The fact we can recognise that we know something, even if we can't repeat it - e.g. you know if someone sings the wrong lyrics to a song even if you can't remember them yourself - MUST have some solution to this problem embedded in it somewhere...
This requires the password to be stored in clear in the system. I think the brain is more trustworthy than that...
We need to recall the password after 1 year or even 2.
Please, go on with the tests!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Who has 45 min to learn a new password? I can't see a company willing to
pay someone for 0.75hr just to learn a password.
-AI
Well then I suppose you would find a company who finds no point in protecting their most valuable asset (people) from losing their second most valuable asset (information).
Maybe the senior executives would sing a different tune if you showed them that 75% of their current workforce passwords were cracked in 45 seconds or less.
Or they just might figure that people who lack the capacity to memorize a reasonably complex password may not, after all, be all that valuable of an asset.
Who would allow a truly secure system to have static passwords - most require a change once a month. Now it costs 9 hours a year, or 0.5% of your entire payroll costs just to learn the passwords. Since the sequence must be played back using a large string of random sequences in which the password sequence is embedded, I presume that would probably take at least 2 minutes to be of both necessary and sufficient length. Let's presume that you only have to log in twice a day (when you arrive, and when you come back after lunch) to this truly secure system...that's 4 minutes a day or another 1000 minutes ~ 16 hours ~ a year. Now we're up to 1.25% of employee costs. If you have a 100,000 person company with US average wages (and they'll probably be higher than average if they're logging into a secure system), that's $75,000,000 a year.
Now, tell me again how much the executive board splitting an extra $75,000,000 in bonuses is going to react when you tell them that they need this highly secure password system, compared to the one they have that had resulted in few or no breaches in the past decade.
Is it just my observation, or are there way too many stupid people in the world?
A few readers have commented that the system will need to know your unhashed password. This is clearly bad, but there are even worse flaws.
A 30-character password sounds awfully strong (60^30 combinations if upper/lower-case chars and numbers are used). However, from the article: "Authentication requires that you play a round of the game — but this time, your 30-letter sequence is interspersed with other random 30-letter sequences". This means that the number of characters is irrelevant, really. What matters is the number of "30-letter sequences", and since you need to play them all, they will need to be limited. How many? 10 would probably too many to play, but will still only be the equivalent of a single-digit password. This system will be trivial to crack with brute-force guesses.
Even worse, repeated "login attempts" will reveal which sequence is the correct one - simply check which sequence repeats between tries.
the hose isn't necessary. Just the rubber would do, I guess.
Bert
and I can never remember exactly how many "na-na-na"s go in between the "hey, hey, hey"s and the "good-bye"s.....
(welcome to MY hell, and you're welcome!)
No boss, I'm not playing Guitar Hero/Portal/Diablo, I'm trying to log into the network...
Hence "rubber hose", I guess.
Also FatPhil on SoylentNews, id 863
How many standard deviations above 'random guessing' are we talking about? Over how many trials? And 2 weeks is fine, but what about 6 months to a year?
You're missing the point. They're missing the point. It's easy to make one password secure against guessing it in a million years of trying.
But I don't need to remember one password. I need to remember thirty passwords (for my most important stuff, plus another fifty for sites I visit once or twice), all different, and a large subset of which have to be changed every 60 days. If it takes "a 45 minute learning session" for "the 30-letter password to be firmly implanted in your subconscious brain" this is purely out of the question.
And if the answer is "well, just use the the one password because it's unguessable and you can use it for everything"-- yeah, what could possibly go wrong?
Fail.
http://www.geoffreylandis.com
HAHAHAHAHAHAHAHAHAHAHA... oh wait, you were serious, let me laugh even harder...
To the vast majority of companies out there, you are not an asset, you are a liability on a balance sheet. Nobody can ever work hard enough to justify their salary, no matter how pathetic or insulting that salary is. You are less valuable than the office furniture.
In my experience, no 'senior executive' is technical enough to understand that phrase. Their eyes glaze over when you try to explain the need for passwords at all, let alone more secure ones. Then when you tell them that they need to jump through even the slightest hoop regarding security, the first thing they tell you is to make an exception for them, because they don't want to be any further inconvenienced. (Most of them resent the idea that they have to put in a password at all , let alone a reasonably secure one. Their convenience is far far FAR more important than data security, because they understand the former much more than the latter.) The second thing they tell you is do it or you're fired. I have first-hand knowledge of this attitude from multiple Fortune 500 companies as well as public sector entities. I've worked at places where the CEO's password (for EVERYTHING they access, from email to file shares) is the name of the company. And set to never expire. And known to everyone in IT, lest there be a problem with it.
Security at most big companies is a bad joke. You can yell and scream and beg and cajole and do anything you can think of to explain why what you're doing is grossly inadequate, but all it will get you is fired.
Never underestimate the power of stupid people in large groups.
Well, then your account is safe, but you get to expereince "or else". The problem with any rubber hose proof system, is getting the people with rubber hoses to agree that there efforts won't work.
Well.. maybe. Or Maybe not. But Definitely not sort of.
http://xkcd.com/851/
Is there a topic for which there *isn't* a XKCD comic?
I am an ACCA student. Got a query on Accountancy/Finance? Maybe I can help!