Slashdot Log In
Microsoft Wants To Give You A Rorschach
Posted by
ScuttleMonkey
on Wed Dec 05, 2007 03:55 PM
from the sticky-note-to-put-on-your-monitor dept.
from the sticky-note-to-put-on-your-monitor dept.
Preedit writes "Microsoft has set up a website that uses inkblot images to help users create passwords. The site asks users view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password. Microsoft claims it's a way to create passwords that are easy to remember but hard to crack. But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not sure this will help (Score:5, Funny)
I got vavavapsva.
More seriously, if they're saving the word associations, doesn't that mean that they have the password you've just generated?
P**n (Score:2, Funny)
Re:P**n (Score:5, Interesting)
Something like "I am a happy person who loves their life." turns into "Iaahpwlt1", which is long, contains numbers and letters and no dictionary words whatsoever.
You end up repeating it to yourself every time you log in, which serves double duty as both a mnemonic device and a way to preserve your positive attitude.
Parent
I get it (Score:3, Funny)
You're right I feel better already! Wow everything feels faster! Any more exclamaitions and I'd be using Yahoo!!
Re: (Score:3, Funny)
I use mnemonic devices also, but perhaps I should rethink my current "Nobody loves me, I wish I were dead" password. Oh, what's the use. It wouldn't matter anyway.
Re: (Score:3, Funny)
Here, let me try one:
People Always Say Something's Wrong Or Really Depressing.
Awesome! I'll use it on all my accounts!
- RG>
Re: (Score:3, Funny)
I'm not sure whether I should be afraid of your mind or the site...
Re:Not sure this will help (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
You, sir, have a filthy mind! =)
Cheers
Re: (Score:3, Funny)
Vanillia? Viagra? Volousia? Pens? Va....oh wait (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Obligatory Emo Philips (Score:5, Funny)
I said, "Oh, it's kind of embarrassing."
He said, "Emo, everyone sees something, so don't be embarrassed. Tell me what the inkblot looks like to you."
I said, "Well, to me it looks like standard pattern #3 in the Rorschach series to test obsessive compulsiveness." And he gets kind of depressed.
I said, "Okay, it's a butterfly." And he cheers up.
He said, "What does this inkblot look like?"
I said, "It looks like a horrible ugly blob of pure evil that sucks the souls of man into a vortex of sin and degradation."
He said, "No, um, the inkblot's over there. That's a photo of my wife you're looking at."
"Oh," I said, "was I far off?" He said, "No. That's the sad part."
Parent
I'm shocked!!! (Score:5, Funny)
Slight problem with this approach (Score:5, Insightful)
Uppercase letters
Lowercase letters
Numbers
Non-Latin characters (i.e. symbols)
Every password I use has at least three, even for free-registration-required sites...
My slashdot password (Score:2)
Don't tell anybody, ok?
Re:Slight problem with this approach (Score:5, Funny)
Parent
Re:Slight problem with this approach (Score:5, Insightful)
Or are you going to tell me that
"atrulystrongpasswordshouldhaveatleastthreeofthefollowingifnotallfour"
is not a strong password?
I'm not suggesting everyone should use such a long pass, but what's so hard about implementing passphrases instead of passwords?
Parent
Re:Slight problem with this approach (Score:5, Interesting)
For example, is passwordpasswordpassword any harder to remember than just password?
But it greatly expands the key space to be searched for anyone trying to brute force...
Parent
Ob. Schneier (Score:3, Funny)
Re: (Score:3, Insightful)
Chances of a typo are even higher if someone routinely types in MS Word with AutoComplete turned on and is now physically incapable of typing "the
Re: (Score:3, Interesting)
I agree with you, but the problem for the average user is that they are not touch typers. They are constantly looking at the keyboard and screen to confirm what they have typed. As the length of the password increases, the odds that a typing error is going to be made also goes up. As passwords are blocked out, it would be very frusterating to a person who has to look at the screen to confirm what they have typed and backspaces often.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
In both experiments, users missed at most one association, even after having not used the system for one week. Thus it may be advisable to modify the system to allow for successful authentications when k out of a possible n associations are correct. Assuming that all blots produce an equal distribution on responses, this reduces the security of passwords to the level of the original system with only k blots. Therefore, it might be advantageous for users to have to enter associations for more blots. A disadvantage of this approach, however, is that authentication would take longer.
As of interest may also be their conclusion:
Our preliminary data suggest that inkblot authentication offers a potentially significant improvement over existing widely-deployed user authentication mechanisms. In addition to gathering our quantitative results, we also asked users who had taken part in our experiments for their comments on the system. In almost all cases we received the same response: the users were happily shocked that they could remember such a "huge password." In fact, many users asked if there were any plans to allow the use of the system in their production environment. This kind of positive user experience is arguably as important to the eventual adoption, acceptance and scrupulous use of an alternative password system as any measure of security. More experiments would help confirm or discount our security and memorability results, and could answer such questions as: How many inkblots (that is, how much entropy) can be used before the resulting passwords are no longer memorable? What is the best way to help users retain their inkblot associations? What inkblot-to-character hash function generates the most entropy without sacrificing ease of use? And what inkblot generation algorithms create inkblots with the highest-entropy (or the fewest low-entropy) association spaces?
While inkblot authentication should be quite easy to deploy in a wide variety of settings, there exist some environments (such as devices with tiny screens) where it is unworkable, and alternatives are needed. Adapting the inkblot password scheme to other password-using contexts, such as those in which the user interface is under the control of a (possibly uncooperative or legacy) application, may also require some innovative thinking.
Re: (Score:3, Insightful)
Re:Slight problem with this approach (Score:4, Insightful)
Uppercase letters
Lowercase letters
Numbers
Non-Latin characters (i.e. symbols)
That's just not true. Admins request this kind of nonsense to force a bigger password space with shorter passwords. Informally, the security of your password is given by the number of random bits you have. With ASCII passwords using only lowercase letters, you're adding less than 5 bits of randomness per character. Even worse, most people use real words as passwords, so they can remember them easily. That reduces the randomness even more and makes dictionary attacks feasible. Adding uppercase, numbers and symbols gives you an extra bit or two of randomness per character, but makes the password much more difficult to remember.
Microsoft's method works around the password memorization by using the inkblots. The security is given by the much larger size of the resulting password. They get a password of 20 lowercase characters, say about 100 bits of randomness (less than that, because not all letter combinations are equiprobable - very few words I know begin and end with a q for example). A totally random password consisting of a mix of 10 symbols, numbers and different cased letters only gives you a bit less than 70 bits of randomness.
Parent
Hmmmm .... (Score:5, Interesting)
So, psyche 101 was a long time ago, and that's the extent of my exposure to it.
Do individual people respond to the same inkblots, the same way over time? Or might I see the same splotch in 3 months and associate something else with it? If there's drift over time, this wouldn't be such a good idea.
Anyone with a better schooling in human psychology care to chime in?
Cheers
Re: (Score:3, Interesting)
I don't know, but about three years ago, I recall suggesting the use of non-abstract images and measuring the brain's electrical response to determine a map of the user's response to a given stimulus. After the system was trained properly, you could use that to be a really, really solid passphrase; while your brain may react a bit differently to images over time, it isn't likely to react dramatically differently for the most part (except maybe after head trauma or something similarly extreme). This seems
Don't do it... (Score:5, Funny)
Re: (Score:2)
-mcgrew
And zees one? (Score:2)
Re: (Score:2)
BEWARE the breasts of DOOM! (Score:2)
random? (Score:3, Funny)
db
Ballmer's unencrypted file (Score:5, Funny)
chair
developers
chair
banana
ooohshiny
developers!
developers!
developers!
Storing and insecure (Score:5, Informative)
From the actual site:
InkblotPassword.com is a research project deployed by Microsoft Research. It is for demonstration and research purposes only. You are welcome to try it out, but we make absolutely no promise that our implementation will protect your password. Don't use your account here to protect any data you care about, from money to your reputation. We also make no promise that the site will continue running. Should the service prove successful, Microsoft may consider offering the service as a commercial product or service. For now, consider it an unreliable, insecure service run by a couple research coneheads in their spare time, and trust it accordingly.
Wait... (Score:5, Interesting)
No way.... (Score:2, Funny)
If this is anything like a wet willy, I don't want one, and you can't make me.
*runs away screaming*
Same password for different sites == bad security (Score:2)
It's even more important that people not do this. If your password is the same for 15 different sites, and one of those sites gets hacked (or even phished, or someone keylogs your password) suddenly that hacker has access to your account at
Reusing the password (Score:5, Insightful)
Common sense might.
All I keep seeing... (Score:5, Funny)
Captcha (Score:5, Interesting)
Please select all the cats. Pictures supplied (and sponsored) by petfinder.com. Brilliant. Even HAL-9000 might not be able to do that.
Re: (Score:3, Informative)
This is just a beta test for the m$ psychological. (Score:2)
Rorschach inkblot test (Score:2)
(obligatory link for the uninformed)
Rorschach Inkblot Test [wikipedia.org]
Silly... try a leet password generator (Score:3, Informative)
Try a leet password generator [goodpassword.com]... way easier to remember!
Re: (Score:3, Funny)