Printable View
Microsoft is working on a new password scheme, based on images:
The Register: Picture this: image-based passwords
Now ... would this really offer more secure passwords, or would people still write down the combination on a yellow Post-It stuck on their monitor?
Cheers,
BrainStop
Hmm, interesting, but I'd still rather have a 17-char mixed case with numbers & symbols text password, than clicking 4 or 5 images.
I would much rather type my password than click "Tux" (twice) "O'reilly Linux book" (once) "Pam Anderson" (once) "Tom Green" (once) "Bill Gates" (once) - :D
Also where are these pictures located, and how many other pictures are mixed in with them?
I agree that pictures are much easier to remember than ttp45pwd500 or whatever.
MS is probably suggesting this new scheme of security, because they are targetting consumers are barely computer literate.
Agreed, gstudios.
I could actually remember a text password easier than a picture sequence, since I download hundreds of wallpapers, logos etc. a day, I'd never remember one from the other.
it woujld just become habit though think about it would u rember 123jhf432 of by heart if u didnt use it everyday i think its a shitty idea but worth a think
But if people wanted to break into it, it would still be possible. I mean you can create scripts that would pick one user ID and then just run until they got the right combination of pictures clicked. I don't see how it could be more secure then a very good text-based password, such as 'du3Pg90dZs6a' or something. I understand that 'du3Pg90dZs6a' might be hard to remember, but when you enter it all the time, it would become second nature.
Mind you, I haven't seen this new security idea 'in action', so it could be more advanced, but that's what I gathered from reading that link.
Greg
I don't think the issue is wether these picture thingies are more secure, but rather that they are easier to remember so that people might stop using passwords like "Emma" or "tomgreen".
I don't think this password scheme will be taken to seriously over the next few years. Brute forcing will still be possible, and this is just an 'easier' way of punching in a password. Whoever is familiar with BF'ing, then you should know that
i23ot9u2oijw0982ijt
Will take about forever to get with just one PC, while on the other hand, clicking an image one or two times in sequence isn't so hard. Only if the number of clicks increases, but obviously few people will select one picture and one click.
This is just a lazy-people's way of entering a secure website. I only hope that this isn't something like:
- Click number one on 56k
- Wait for page to refresh
- Click number two
- wait for page to refresh
- etc.etc.
....man.
Something about this idea doesn't sit right with me... Are these picts stored on a website or in a locally based program? Is the passowrd the location clicked, and the picts are just a cute way to indicate position? This sounds like a keypad with pictures instead of alpha-numerics....but I could be totally off on this one...
I can't see this catching on.
nah. I'll stick with alphanumeric.
It makes psychological sense, but it's still silly from a security perspective. It will just encourage people to pick even MORE EASILY guessed things, such as "Windows---Heart---Bill Gates---START BUTTON"
I would have to agree with most of you. But I am wondering, how many pictures is the user allowed to pick from. Knowing microsoft it will probably be around a couple hundred. Ok. Will that same couple hundred be on every windows computer? Not so good. Or are you going to be able to use your OWN pictures? More secure, i would think. I can see this thing becoming secure, or as secure as easy-to-guess passwords. Time will tell.
I will always use to good ole' standby for a password. "letmein". <grin>
On the serious side. The more complex the better. I believe alpha-numeric will always be better and harder to crack than click-a-pic. I mean how hard would it be to crack a few mouse clicks? Compared to a password such as: @$%$97$$@3566)(**&&(*!@!>~++hP:'"% encrypted to a 128 bit or greater key. Hmmm. Tough choice? NOT. I'll stick with my good old passwords. Leave it to M$ to try and goof things up.
this is not a new idea... i forget the exact number of image in sequences the brain can remember but it's quite a few...
the interesting question to me would be implementation...if image 1 = A and image 2 = b from a stock of x number of images... well...not so interesting but....if could you pick your own images...hmmmmm
how bout this..
develop some kind of key based on pixel patterns in each image..given that the each picture could be virtually unique
even i you knew the picture was a picture of my cat...was it taken in doors, in low light, did i manipulate the color...etc...with a 32kbit color depth you have a lot of 1's & 0's to play with...
...this could be like some kind of "pixel dna sequence" (pds)?
then have several image pds's in a string you'd have to know each pds and it's correct order...would think it could be very strong...and user friendly...which would be a first...
thoughts???
(heading to the patent office now...hehe)
Forget that, those whack crazies at microsoft didn't just come up with this. Plus, it'll be even harder for the average computer user to remember a series of pictures. The human brain remembers things in 'bits' and 'chunks', and it's much easier to chunk a string of alphanumeric text, than it is chunk a series of pictures located all over the screen in a different order. I think it's highly unlikely that this will catch on.
Agreed. Human psychology dictates that this is even less secure and user-friendly than text-based.Quote:
Forget that, those whack crazies at microsoft didn't just come up with this. Plus, it'll be even harder for the average computer user to remember a series of pictures. The human brain remembers things in 'bits' and 'chunks', and it's much easier to chunk a string of alphanumeric text, than it is chunk a series of pictures located all over the screen in a different order. I think it's highly unlikely that this will catch on.
I mean, if there's a Windows logo amongst the pictures, how many millions of users will just use that (And Only That) as their "pass-sequence"??
Whereas, if its text based, yeah it could be 'password', or 'letmein' or any of a multitude of others... i.e. text is always gonna be more secure, based on limitations of the human memory.
Hotspots.
Images as passwords are not only about image sequences with several different pictures involved. They do develope a method were you freely can choose lets say five spots on one picture (not marked spots). If you had a 640*480 image with 72 dpi in resultion it would be a lots of numbers if every pixel was a number and every hotspot was approx 10 pixels wide and high. This method should not be unbreakable but lots worse to crack then traditional passwords. The problem would maybe be to develope this hotspots in a picture, but they already have methods for it.
Just wanted to share..
~m
if that was the case then we'd all be running dos and unix command lines...Quote:
Plus, it'll be even harder for the average computer user to remember a series of pictures
humans are absolutely image based....in fact what is text but an image representing a concept...
the maximum sequence of alpha numerics most people can cope with without "chunking" (splitting the sequence up") is 7 characters...
i'm doing some googling right now...i soon as i can fiind the right question to ask...i'll post back...
Found some more information on this topic.
Reuters
But then later on in the article:Quote:
People could use any image, the more complex the better, or even video, according to Kirovski. The images would have to be doctored to work with software that could convert pixels to numbers and encrypt them.
Pictorial Passwords -SlashDotQuote:
In general, it might be more secure, he said, "because people choose such lousy passwords."
Using Images as Passwords -SlashDot
I'm all in favour of educating users instead of implementing new fangled password authentication schemes. If users don't take security seriously, it doesn't matter how good your authentication system is. They still leave the system vulnerable to exploitation.
I agree.Quote:
I'm all in favour of educating users instead of implementing new fangled password authentication schemes.
Ok, so let me see if I get this straight....
Your password is a sequence of pictures that the user chooses? These pictures are stored on the hard drive of the user, and all are of the same format...? If this is the way that the system would work, I think I see a small problem: anyone who was able to break onto the usres hard drive would be able to search for all the image files that fite the pparamaters of the password scheme, and then uses those in a cracking program to break this password. I think that this would severly reduce the nuber of possible passwords, and make it very easy for an individual dto break the passowrd. Almost like having a dictionary on the hard drive from which the pass "phrase" must come from...
I could be completely off on this....
but you are probably not.