New password system lets planet Earth do the hard work Log-in credentials derived from geographical information could reduce the majority of data breaches by providing an almost uncrackable replacement for conventional passwords, according to security researchers. ZSS-Research of Ras Al Khaimah in the UAE has developed a system which requires users to choose a favourite place …
A couple of years back The Reg had an article about passwords where the user would draw over some notable features in a photo, sounds like the same thing.
Problem is for my password for say the Royal Albert Hall Ticket Office, aren't I going to trace the RAH? Along with everyone else...
And the reason why the "draw on an image" password method was rubbish was because people would be very unimaginative and pick out the things practically everyone would.
No matter what you do, if you are going to leave it to people to self select their method of identification you will always have people who pick bad/obvious identifiers.
How many people will choose the Eiffel Tower, the top of the Empire State Building, or some other well-known landmark? Will the system have to enforce not choosing such spots the same way you're forced not to use "password" as your password?
Even if you choose a place that wouldn't be guessed by strangers, what about your friends? What about your ex-wife, who knows you very well, trying to choose locations she wouldn't guess but you could still remember well?
Even if all those concerns are avoided, if your "password" becomes known just once, then you need to think of a new location. Plus, you wouldn't want to use the same location for your bank as Facebook, so you'll need multiple locations.
Seems like it has all the problems passwords do.
"Seems like it has all the problems passwords do."
But think of the password policy fun!
* Cannot use location on the same continent for <insert choice here>.
* Password fails atlas lookup.
* If you have been there we would really like to talk to you...
* .....
As someone who keeps dicking around with online maps a lot, I can't help noticing that selecting a specific location on a map (ie. zooming into it from a suitably generic start level) is not exactly a fast operation - I bet I could type even my longer passwords faster than that. Also, this sounds like it's aerial-view based (if you might see a tree on it) - so what happens when your map supplier updates the imagery, and your chosen spot suddenly becomes an invisible white smudge in a white field of... snow?
I know where my passwords are written down.
Seriously, most websites that ask for passwords don't need them - or only need trivial examples as what they "protect" is, to all intents and purposes, worthless. For these sites: the overwhelming majority of sites, keeping the same passwords for all of them and never changing it is perfectly reasonable. Provided websites continue to allow anonymity: i.e. anyone can set up an account using any old "nickname" that hasn't already been used, there isn't even any reputational damage if a bad person does hijack your account.
There are some sites: banks, any website that you make payments to/from, HMRC, places where you expose contact information to people you know (since you owe them a duty of care) where it is wise to keep passwords under wraps - and not use the same one that you would on snailracers.com snail fanciers forum. However, for those a solid password is at least as good as trying to remember a location (who would NOT choose the location of their house, or the bank branch in question?) and is easier to record, if you have a geographically based password system like mine.
Surely this will make it easier for people to look over your shoulder when you're logging in and make it easier to steal passwords?
Text passwords are harder because it's often too long and difficult for people to keep track when I type it in, especially with the use of the Shift key for capitals or special characters.
That's one obvious flaw - not so much for 80x25 terminals, but Braille-readers and similar: how exactly do blind people draw on a map they can't see? Passwords are fine, they can touch-type, but a map?
Even an 'obvious' location won't be as obvious as a password of 'password' though: ok, the Eiffel Tower is a major landmark - but so's the Empire State Building, Niagara Falls, the Leaning Tower of Pisa ... if I were to tell you I'd picked an obvious major landmark as mine, which would it be?
My brother might pick the church he got married in - or the hotel the reception was in, or the one the honeymoon was in. Or maybe the first school we both attended, or the house we lived in at the time (both in the countryside, so easy to pick out on a map) - ALL 'obvious' places to someone who knows him well, so which would it be? Those span two continents and only one is within a few miles of his home, and I could think of another dozen equally "obvious" places he might pick instead.
Compare that with the usual: mother's maiden name, place of birth, siblings and offspring? All listed on Facebook, for a lot of people! Much easier to find. Add a hint like "bad NY hotel" and you have a specific building I could find in 10 seconds on Google Maps - and it's not in New York, either, that would be too obvious.
> That's one obvious flaw - not so much for 80x25 terminals, but Braille-readers and similar: how exactly do blind people draw on a map they can't see?
"Using Logo?"
No, using Broil!
Errr, I am sorry I will feel that again. Ahh, Braille.
I'll take that dood in the death zone on Everest! The one with the blue boots.
Also, how is it easy to remember a freehand drawing around an object on a map? Either they need to limit how/what you select a lot, drastically reducing the degrees of freedom, or you'll have a hard time drawing the exact same bounding box.
For most users it is sufficient to use a password manager (I strongly recommend LastPass) and let it manage your long, unique, random passwords.
Now if only someone could do something about sites which limit the length of passwords to some low value and do not allow special characters...
You'd have to trace some key features around your target area (so if a tree, trace either it's foliage or a set of trees that surround it), which is fine until the satellite picture updates and there are changes that muck things up (two trees down in the storms, or the satellite has a different perspective so tall objects appear to shift).
Surely, the input method for this is going to be exceptionally complicated? I want to select Taipei 101... so I have to go hunting on some map for Taiwan, find Taipei, and so on? And do that each time I login?
Or I suppose they could simplify the interface to a text box, and I can type in 'Taipei 101' as my password. Which I could do right now of course.
How will this work in practice? The world is a big place - so I assume you don't have to zoom in from a world map. I recall frightening statistics about how many Americans can't find the USA on a world map, and I would imagine things aren't that different for some Brits. If they can't find their own country how might they find another one, or find their town, let alone "special place" on a world map.
So perhaps instead I first have to enter "wall street new york" and then click/circle a particular area of that location - probably a little better, but ultimately you're still defining a single bit of data that can be used to login if an attacker gets it.
2 factor authentication must be the way to go - where a memorized password is combined with some kind of physical token.
It seems that any hard-to-guess password scheme will always be confoundedly hard to remember. This scheme is not an exception. It is easy to remember one location, but 23 or 123 locations would be no easier that 123 passwords. The same applies to the "keypad pattern" idea talked about a few years ago.
I would say large entropy and hard-to-remember is actually the same thing.
Having to remember and input passwords makes any online system depending upon these weak.
The banks have (largely) solved this by giving everyone a uniquely keyed device with a trivial secret needed with it (chip and pin) and issuing all merchants with a device it plugs into. Something you have and something you know. A standard intended to be usable by any number of servers and users for any number of applications has to be able to do at least as good as this. Initially I think it will be an application run on mobile phones which have the standards compliant embedded crypto chip which can sign stuff or one time entry tokens as you. Those wanting a device which hasn't got other (non security) applications will be able to find such on the open market once the API and network standards etc are well enough defined. Goes without saying these devices should be able to talk securely over Wifi, USB and Bluetooth - mobile phone apps already do. Maybe the SIM card could have some useful crypto extras standardised for this.
If you want better than something you know and something you have, then not too difficult to add a fingerprint reader - something you are, but knowledge of your biometric used to unlock your device need be known only by the user and the security device the biometric unlocks.
The obvious userid is any email address which can be routed to message the security device. No harm and much benefit in having more than one which a security device can sign for. The obvious PKI where certificates for such device keys should be stored and found is DNSSEC.
No such solution will ever be perfect. Questions to ask about new proposed solutions like this are whether it is usable, affordable, open to all developers, and better than what was used for this purpose previously.
This won't help victims from malware that takes screen-video of the location zoom-in, or shoulder-surfers, or ex-partners...
The problem is with static authenticators - doesn't matter if it's text, a picture, a pattern - if the password is a static bunch of 1s and 0s then it can be stolen or guessed/cracked without the knowledge of the owner.
One-time-codes are the only way. But the interwebs-thingy is too (relatively) new for the masses to accept OTCs. Just give it a few more years and it will be a no-brainer for our young padawans.
I'm having a hard time imagining how this system would balance the needs for freedom, repeatability, and hashing. You need a good deal of freedom, or detail in other words, to select what you want who the whole thing loses its appeal. But enough detail to select a tree is also enough detail to create ambiguity in the outline of a hotel. And of course it's also critical that you be able to select the same area again next time from memory. The obvious solution would be to allow a small amount of error, but how can you compare a fuzzy figure to a hash? I guess you could individually test for all possible combinations of off-by-one errors, but I'm not sure that would really be good enough and it would become impractical fast with more than a few variables.
The only way this could work is if each computer has one massive atlas database stored locally. Otherwise each time someone logs in, it's going to have to fetch the atlas data from a central server. That central server therefore contains very a big clues to what all password locations are, and the security of the system relies on one unencrypted point of failure/attack.
Imagine; each morning user Alice logs in, hitting the atlas server for an image of the postcode area SW1A 1AA. Not going to take much to guess what the password location is.
2 factor login is worthless if you can use the same login for multiple sites, and somebody can steal your cookie and view it in their browser, take the string and base64_decode it in any code language and see a plain text string of your password etc and find the exploit to send it from a remote form
http://forums.theregister.co.uk/forum/1/2014/02/18/wordpress_2fa_bug_can_bypass_authentication/#c_2111106
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
