Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unbreakable Crypto: Store a 30-character Password In Your Subconscious Mind

Posted by samzenpus on from the locked-away dept.

MrSeb writes "A cross-disciplinary team of US neuroscientists and cryptographers have developed a password/passkey system that removes the weakest link in any security system: the human user. It's ingenious: The system still requires that you enter a password, but at no point do you actually remember the password, meaning it can't be written down and it can't be obtained via coercion or torture — i.e. rubber-hose cryptanalysis. The system, devised by Hristo Bojinov of Stanford University and friends from Northwestern and SRI, relies on implicit learning, a process by which you absorb new information — but you're completely unaware that you've actually learned anything; a bit like learning to ride a bike. The process of learning the password (or cryptographic key) involves the use of a specially crafted computer game that, funnily enough, resembles Guitar Hero. Their experimental results suggest that, after a 45 minute learning session, the 30-letter password is firmly implanted in your subconscious brain. Authentication requires that you play a round of the game — but this time, your 30-letter sequence is interspersed with other random 30-letter sequences. To pass authentication, you must reliably perform better on your sequence. Even after two weeks, it seems you are still able to recall this sequence."

10 of 287 comments (clear)

  1. repetitive phrases slightly modified by alphatel · · Score: 5, Funny

    This 30-character sequence is played back to the user three times in a row, and then padded out with 18 random characters, for a total of 108 items. This sequence is repeated five times (540 items), and then there’s a short pause. This entire process is repeated six more times, for a total of 3,780 items.

    Replace 'character' with 'note' and it's clear subjects were tortured with Philip Glass for 80 hours and won't soon forget.

    --
    When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
  2. So to recover your password ... by Anonymous Coward · · Score: 5, Insightful

    State Security forces you to play this game?

    1. Re:So to recover your password ... by Dr_Barnowl · · Score: 5, Interesting

      The game only works if the machine knows what your password is, so that you can succeed at playing that sequence better.

      Which reveals the flaw in the scheme ; currently, the computer you are logging into doesn't need to know your password - it stores a hash instead. With this scheme, the machine needs a way to recover your password as plaintext, so that it can test you on it. Which means that if you can sieze the system itself, you can get into it, you just need to extract the password and train someone else to know it.

  3. How ingenious by Chrisq · · Score: 5, Funny

    The "cross-disciplinary team of US neuroscientists" came up with the most original excuse ever for why they were spending all their grant money on games consoles and all their time playing games.

  4. How is that resistant to rubber-hose cryptography? by Anonymous Coward · · Score: 5, Insightful

    Log in or else!

  5. Re:"Reliably better" by Anonymous Coward · · Score: 5, Funny

    He's not kidding. I just logged onto his /. account and posted this after reading the password he posted.

  6. Re:"Reliably better" by rjgii · · Score: 5, Funny

    He must have changed it... I can not log in as "Anonymous Coward" anymore =(

  7. Re:"Reliably better" by errandum · · Score: 5, Interesting

    That is not true. It has been proven that passphrases can be weaker than passwords, simply because words usually follow each other in an ordered pattern.

    You'll be safe from brute force attacks, but not any attack that adds intelligence to the mix. And if the person cracking your password knows it uses music lyrics you love, you'll be even more at risk since it only has to test for the songs you like.

    What you just described is NOT safety.

  8. Only one song stays in my mind day after day... by Anonymous Coward · · Score: 5, Funny

    and I can never remember exactly how many "na-na-na"s go in between the "hey, hey, hey"s and the "good-bye"s.....

    (welcome to MY hell, and you're welcome!)

  9. Re:"Reliably better" by djmurdoch · · Score: 5, Interesting

    But the brute forcer also has to try all sorts of stupid variations:

    One ton O'Mara
    Feel the beat from the tangerine
    Scuse me while I kiss this guy
    I can see Deirdre now Lorraine has gone