Unbreakable Crypto: Store a 30-character Password In Your Subconscious Mind

MrSeb writes "A cross-disciplinary team of US neuroscientists and cryptographers have developed a password/passkey system that removes the weakest link in any security system: the human user. It's ingenious: The system still requires that you enter a password, but at no point do you actually remember the password, meaning it can't be written down and it can't be obtained via coercion or torture — i.e. rubber-hose cryptanalysis. The system, devised by Hristo Bojinov of Stanford University and friends from Northwestern and SRI, relies on implicit learning, a process by which you absorb new information — but you're completely unaware that you've actually learned anything; a bit like learning to ride a bike. The process of learning the password (or cryptographic key) involves the use of a specially crafted computer game that, funnily enough, resembles Guitar Hero. Their experimental results suggest that, after a 45 minute learning session, the 30-letter password is firmly implanted in your subconscious brain. Authentication requires that you play a round of the game — but this time, your 30-letter sequence is interspersed with other random 30-letter sequences. To pass authentication, you must reliably perform better on your sequence. Even after two weeks, it seems you are still able to recall this sequence."

Comments

"Reliably better"

[FireballX301]

How many standard deviations above 'random guessing' are we talking about? Over how many trials? And 2 weeks is fine, but what about 6 months to a year?

I still prefer 80+ character passphrases lifted from song lyrics whenever possible. If you know the song well enough it's impossible to crack, and the search space is still large among people who know you like that particular song

Re:"Reliably better"

[Anonymous Coward]

He's not kidding. I just logged onto his /. account and posted this after reading the password he posted.

Re:"Reliably better"

[rjgii]

He must have changed it... I can not log in as "Anonymous Coward" anymore =(

Re:"Reliably better"

[errandum]

That is not true. It has been proven that passphrases can be weaker than passwords, simply because words usually follow each other in an ordered pattern.

You'll be safe from brute force attacks, but not any attack that adds intelligence to the mix. And if the person cracking your password knows it uses music lyrics you love, you'll be even more at risk since it only has to test for the songs you like.

What you just described is NOT safety.

Re:"Reliably better"

[Joce640k]

There's numerous flaws in your plan, but that's beside the point.

The whole point of this system (which you missed) is that it's secure against rubber hose cryptanalysis (aka $5 wrench cryptanalysis).

Re:"Reliably better"

[djmurdoch]

But the brute forcer also has to try all sorts of stupid variations:

One ton O'Mara
Feel the beat from the tangerine
Scuse me while I kiss this guy
I can see Deirdre now Lorraine has gone

Re:"Reliably better"

[tbannist]

Also, what happens if you're just really good at the game? I mean it's based on you being better at playing your password than other chords. If you're playing everything flawlessly are you permanently locked out?

Re:"Reliably better"

[silentcoder]

Sadly - songs you hate tend to stick in your memory far too well.
How many people can quote "call me maybe" or Justin Bieber's baby.

Now how many of them actually LIKE those songs ?

Re:"Reliably better"

[DarwinSurvivor]

That's a bad example. How hard could it possibly be to memorize a combined 10 words?

Re:"Reliably better"

[cstacy]

11A ...11A2B...1B2B3...Zero-Zero-Zero Destruct Zero

repetitive phrases slightly modified

[alphatel]

This 30-character sequence is played back to the user three times in a row, and then padded out with 18 random characters, for a total of 108 items. This sequence is repeated five times (540 items), and then there’s a short pause. This entire process is repeated six more times, for a total of 3,780 items.

Replace 'character' with 'note' and it's clear subjects were tortured with Philip Glass for 80 hours and won't soon forget.

So to recover your password ...

[Anonymous Coward]

State Security forces you to play this game?

Re:So to recover your password ...

[Dr_Barnowl]

The game only works if the machine knows what your password is, so that you can succeed at playing that sequence better.

Which reveals the flaw in the scheme ; currently, the computer you are logging into doesn't need to know your password - it stores a hash instead. With this scheme, the machine needs a way to recover your password as plaintext, so that it can test you on it. Which means that if you can sieze the system itself, you can get into it, you just need to extract the password and train someone else to know it.

How ingenious

[Chrisq]

The "cross-disciplinary team of US neuroscientists" came up with the most original excuse ever for why they were spending all their grant money on games consoles and all their time playing games.

How is that resistant to rubber-hose cryptography?

[Anonymous Coward]

Log in or else!

Does the server need to know the password?

[kasperd]

It sounds like the way this works, the server will need to know what the password is in order to produce the combined sequence. Doesn't that make it weaker than ordinary passwords? And if you repeatedly get the same random sequence, over time you'll learn that as well. OTOH if you get different random sequences, then it would be possible to extract the original sequence. Did I miss something here?

Standard password security practices.

[mwvdlee]

Their experimental results suggest that, after a 45 minute learning session, the 30-letter password is firmly implanted in your subconscious brain. Authentication requires that you play a round of the game

I'm assuming I'll still be automatically logged out after 5 minutes of inactivity, cannot recover but will have to change my password when forgotten and passwords will expire every month?

Also; the research suggests users will have to perform better on the injected "password" sequences than random sequences... how will they deal with top players that get a perfect score every time for the entire sequence?

Only one song stays in my mind day after day...

[Anonymous Coward]

and I can never remember exactly how many "na-na-na"s go in between the "hey, hey, hey"s and the "good-bye"s.....

(welcome to MY hell, and you're welcome!)

Re:Only one song stays in my mind day after day...

[CrimsonAvenger]

and I can never remember exactly how many "na-na-na"s go in between the "hey, hey, hey"s and the "good-bye"s.....

There are eight "nah" as the previous poster said, but none of them are between the "hey, hey, hey" and "good-bye".

Pretty sure it's "nah-nah-nah-nah, nah-nah-nah-nah, hey, hey, hey, good-bye"....

ONE password?! Fail

[Geoffrey.landis]

How many standard deviations above 'random guessing' are we talking about? Over how many trials? And 2 weeks is fine, but what about 6 months to a year?

You're missing the point. They're missing the point. It's easy to make one password secure against guessing it in a million years of trying.

But I don't need to remember one password. I need to remember thirty passwords (for my most important stuff, plus another fifty for sites I visit once or twice), all different, and a large subset of which have to be changed every 60 days. If it takes "a 45 minute learning session" for "the 30-letter password to be firmly implanted in your subconscious brain" this is purely out of the question.

And if the answer is "well, just use the the one password because it's unguessable and you can use it for everything"-- yeah, what could possibly go wrong?

Fail.

Yet another Obligatory XKCD

[ryzvonusef]

http://xkcd.com/851/

Is there a topic for which there *isn't* a XKCD comic?