Microsoft Wants To Give You A Rorschach

Preedit writes "Microsoft has set up a website that uses inkblot images to help users create passwords. The site asks users view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password. Microsoft claims it's a way to create passwords that are easy to remember but hard to crack. But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."

Not sure this will help

view a series of inkblots and write down the first and last letters of whatever word they associate with each inkblot. Then they combine the letters to form a password.

I got vavavapsva.

More seriously, if they're saving the word associations, doesn't that mean that they have the password you've just generated?

Re:P**n

I usually suggest to people that they come up with a positive self talk phrase, take the first letter of each word, then replace a letter with a number that resembles it.

Something like "I am a happy person who loves their life." turns into "Iaahpwlt1", which is long, contains numbers and letters and no dictionary words whatsoever.

You end up repeating it to yourself every time you log in, which serves double duty as both a mnemonic device and a way to preserve your positive attitude.

Re:Not sure this will help

vulva vulva vulva penis vulva? I'm not sure whether I should be afraid of your mind or the site...

Really? I'm not sure whether I should be afraid of his mind or immediately go to the site...

Obligatory Emo Philips

"Emo, what does this inkblot look like to you?"

I said, "Oh, it's kind of embarrassing."

He said, "Emo, everyone sees something, so don't be embarrassed. Tell me what the inkblot looks like to you."

I said, "Well, to me it looks like standard pattern #3 in the Rorschach series to test obsessive compulsiveness." And he gets kind of depressed.

I said, "Okay, it's a butterfly." And he cheers up.

He said, "What does this inkblot look like?"

I said, "It looks like a horrible ugly blob of pure evil that sucks the souls of man into a vortex of sin and degradation."

He said, "No, um, the inkblot's over there. That's a photo of my wife you're looking at."

"Oh," I said, "was I far off?" He said, "No. That's the sad part."

I'm shocked!!!

microsoft is collecting and storing the data. holy crap, batman, what next. the joker has plans to take over gotham city?

Slight problem with this approach

This method will not create passwords that are strong enough. A truly strong password should have at least three of the following, if not all four:

Uppercase letters
Lowercase letters
Numbers
Non-Latin characters (i.e. symbols)

Every password I use has at least three, even for free-registration-required sites...

Re:Slight problem with this approach

This method will not create passwords that are strong enough.

That's why I use the inkblot test, run it through a script that converts random letter combinations to MD5, convert 25% of that end result to l33t, and then randomly add a non-latin character at two locations within that result. I then write it down on my desk calendar.

Re:Slight problem with this approach

A truly strong password should have at least three of the following, if not all four:

Only if there's a maximum character limit on the password.

Or are you going to tell me that
"atrulystrongpasswordshouldhaveatleastthreeofthefollowingifnotallfour"
is not a strong password?

I'm not suggesting everyone should use such a long pass, but what's so hard about implementing passphrases instead of passwords?

Re:Slight problem with this approach

I also highly suggest, right now, that everyone change your passwords to currentpassword x 3 or 4, or more:

For example, is passwordpasswordpassword any harder to remember than just password?

But it greatly expands the key space to be searched for anyone trying to brute force...

Re:Slight problem with this approach

This method will not create passwords that are strong enough. A truly strong password should have at least three of the following, if not all four:
Uppercase letters
Lowercase letters
Numbers
Non-Latin characters (i.e. symbols)

That's just not true. Admins request this kind of nonsense to force a bigger password space with shorter passwords. Informally, the security of your password is given by the number of random bits you have. With ASCII passwords using only lowercase letters, you're adding less than 5 bits of randomness per character. Even worse, most people use real words as passwords, so they can remember them easily. That reduces the randomness even more and makes dictionary attacks feasible. Adding uppercase, numbers and symbols gives you an extra bit or two of randomness per character, but makes the password much more difficult to remember.

Microsoft's method works around the password memorization by using the inkblots. The security is given by the much larger size of the resulting password. They get a password of 20 lowercase characters, say about 100 bits of randomness (less than that, because not all letter combinations are equiprobable - very few words I know begin and end with a q for example). A totally random password consisting of a mix of 10 symbols, numbers and different cased letters only gives you a bit less than 70 bits of randomness.

Hmmmm ....

From TFA:

"A century of psychological literature indicates that inkblot associations are intimately personal, and our own user studies verify that users almost always describe the same inkblots quite differently"

So, psyche 101 was a long time ago, and that's the extent of my exposure to it.

Do individual people respond to the same inkblots, the same way over time? Or might I see the same splotch in 3 months and associate something else with it? If there's drift over time, this wouldn't be such a good idea.

Anyone with a better schooling in human psychology care to chime in?

Cheers

Don't do it...

The blots are coded to shut your brain down if you don't have a valid regkey.

And zees one?

For those who haven't seen it, Perry Bible Fellowship's [pbfcomics.com] take on this. [pbfcomics.com]

random?

Respond with "butterfly" and share your password with half the english-speaking planet.

db

Ballmer's unencrypted file

Anyone wanna bet Ballmer's word list looks a bit like this:
chair
developers
chair
banana
ooohshiny
developers!
developers!
developers!

Storing and insecure

It's a research project so of course it's storing the responses.
From the actual site:

Security and privacy of this service

InkblotPassword.com is a research project deployed by Microsoft Research. It is for demonstration and research purposes only. You are welcome to try it out, but we make absolutely no promise that our implementation will protect your password. Don't use your account here to protect any data you care about, from money to your reputation. We also make no promise that the site will continue running. Should the service prove successful, Microsoft may consider offering the service as a commercial product or service. For now, consider it an unreliable, insecure service run by a couple research coneheads in their spare time, and trust it accordingly.

Wait...

So they have created a method for creating hard to crack passwords while simultaneously collecting the data to more easily crack them?

Oblig Watchmen

MS wants to give me a cool mask and let me eat beans from a can? Do I have to keep the journal too?

No way....

Microsoft Wants To Give You A Rorschach

If this is anything like a wet willy, I don't want one, and you can't make me.
*runs away screaming*

Same password for different sites == bad security

From TFA:

Given that many Internet users employ the same password to gain access to dozens of Web sites, for everything from banking and shopping to socializing, it's more important than ever that they create passwords that are at once highly secure and easy to remember.

It's even more important that people not do this. If your password is the same for 15 different sites, and one of those sites gets hacked (or even phished, or someone keylogs your password) suddenly that hacker has access to your account at 15 different sites. This could ruin your whole day.

Reusing the password

"Nothing prevents a user from learning a strong password on Inkblotpassword.com and then reusing it at other sites," Microsoft's researchers said.

Common sense might.

All I keep seeing...

...is penguins.

Passwords tell you a lot

I find it interesting when looking at passwords because it tells you a lot about the person. A computer person will have something like H2xkls23. Where as kid might have MyFavoritePony.

Captcha

That site [inkblotpassword.com] has one of the best captcha's I've ever seen.

Please select all the cats. Pictures supplied (and sponsored) by petfinder.com. Brilliant. Even HAL-9000 might not be able to do that.

This is just a beta test for the m$ psychological.

This is just a beta test for the m$ psychological evaluation system.

Here I thought Microsoft were Watchmen fans

After reading the headline I got excited thinking Microsoft was helping to boost Watchmen popularity, damn.

Rorschach inkblot test

(obligatory link for the uninformed)

Rorschach Inkblot Test [wikipedia.org]

Character randomization

I think it would have been a little more clever if Microsoft did it in respect of their own password strenght good practices... If at least their algorythm randomized characters, like sometimes using an "i", sometimes using a "1", sometimes using capital letters. It's a classic, but it would have been a little more secure to have "trA1nIng" as a password, than to have "tgfryrmd". Brute forcing is a lot easier with only one character class...

Insecure?

I thought strong passwords avoided the use of words as they are subject to brute force dictionary attacks. An e.g. 8 character output of this method may be marginally more secure than one or two words that total 8 characters, but it is also very susceptible to a dictionary attack, maybe even more so as there is a good chance that animals and shapes would be the words chosen (not colours, names of people, verbs etc.).

rorschach?

Rorschach? Is that like a wedgie?

Several flaws immediately come to mind

The image associations are not only unique to the user, they're also "hard to forget," the researchers said. "After typing her password several times, a user develops 'muscle memory' and can log in quickly without referring to the inkblot images," they said.

No shit. Type any password enough times your fingers learn where the keys are, even if you're not consciously thinking about what you're typing.

So their aim is to have you look at the inkblots, work out your passwords, type the password until your fingers get it, and then you don't have to look at the inkblots any more No numbers, no mix of uppercase and lowercase, and no punctuation. Doesn't sound particularly

Running APG [nursat.kz] over a web interface and getting pronouncable, strong passwords which will develop into muscle memory just as easily sounds like a much better solution.

Not to mention the the whole "oh btw, we're storing your associations" bit. It should be painfully obvious that when it comes to security, Microsoft simply doesn't "get it".

dead site

Looks like it's been /.'d. Strange as I thought it was an MS site (although IP 72.44.41.236 goes to Amazon.com). Thought: why doesn't /. get /.'d?

Enter the...

Dot Matrix...

Is this really new?

Eventually it'll be something done by Open Source from the future SeaCode employees...

But, also, hasn't this been show in Sci-Fi shows? (No, I'm not talking about "cheating" to make a result/action appear on screen). It would be ghastly if a patent is "awarded" for this...

AKA Pain In the Ass

Oh great. I have to match my wild-ass guess of a past time with the precise values I chose in my WAG. Sounds like a nightmare.

I use a keyboard patern nemonic

I use a keyboard pattern mnemonic for all my passwords that I change every six months (work-pattern, bank-pattern, overseas accounts pattern ...).

Any 12 characters (1a...!A...) I never repeat, but I always recall, because of the pattern matching I must always recall the first character to enter, then I follow the appropriate pattern-match.

When I take vacation and return to the office two weeks later ... I sometimes forget the pwd, but I always guess right by the third time (most on second try).

Example: c6b8g7j9C^B*J( [works everytime 4me]

!HAVEFUN!

Resistance is futile...

The phrase "Microsoft Genuine Password Advantage" scrolled through my mind and I was afraid.

Possible Microsoft ink-blot results:

• A woman with large breasts
• A woman with small breasts
• Steve Ballmer with breasts
• Harry telling me I'm not good enough
• Harry telling me I can't marry his daughter

phishing

Microsoft is collecting and storing users' word associations

So essentially this is a phishing site, and they're telling you that up front. Of course MS is aware that if you take a sample 1000 people who have fallen for a phishing scam in the past and send them to this inkblot password site with a disclosure that their password will be recorded, 1000 of these will go ahead and use it anyway. It's a great way to do as the criminals do, and through a simple legal disclosure it's no longer a crime.

db

Halfbaked Idea

Seems like an idea I came up with in May 2005: http://www.halfbakery.com/idea/Rorschach_27s_20Password [halfbakery.com] I accept checks, Microsoft.

Easy ways to get random pass-foo from books.

Pin numbers:
Open a large book on random pages and note down the LAST digit. Repeat until the pin is long enough.

For passphrases:
Pick a book, open it on a random page and note down the first word on that page longer than 3 characters. Generate 2 pass phrases this way and insert the acronym of one of them into the other. Add some random special characters and numbers at random places (i.e chosen as for pin numbers ).

May well be vulnerabilities in there, but if you know enough about computer security to avoid exposing yourself to orders of magnitude greater ones, then chances are you are able to generate a good pass phrase.

That is stupid, hard passwords are easy.

Example:
My brothers initals ar JaL and FdL
My Wifes Birthday and month 01/01
My first toby was 'Toby'
dd a letter to rotate

yb0T0101JaLFdLa

Bam, I just created personal and hard password. The bibbes argument against that is that 'everybody knows all about you'. In that case, this information is just noise in the data.

or
!5b00B_g1B
Easy to remember for a human.
No, none of the information given in the example is accurate.

Also, put the password in your wallet. You do not need to put what the password is to, you'll remember it.

Hmmm. I see a Ballmer throwing a chair... n/t

Duck!

What I find interesting

is that although the directions clearly tell you to put in the first and last letters of the word the inkblot makes you think of, you can input numbers, common symbols, and even weird symbols ( and f are both considered valid inputs, for instance) and it doesn't even flinch. I suspect these researchers are going to have to sift through a LOT of bad data to get any kind of meaningful results.

WTF, I have to select a bunch of cat pictures?

WTF? Yet another annoying captcha. Half the pictures are so shitty I can't tell if it's a dog or a cat.

I'm just leaving my password at "changeme" and getting on with my life.

Doesn't that defeat the purpose...

"Microsoft is collecting and storing users' word associations."

Doesn't that defeat much of the purpose in making a password harder to crack... If there is a database with the most common associations and someone unscrupulous gains access to that database, wouldn't that give them a big advantage to crack password generated with this system?

bah... already released!

With Windows Vista, I find myself frequently thinking: hmmm... this looks a little like a network configuration dialog box... no, wait... it's the network status box... no, actually it looks more like... etc.

What a bunch of perverts!

I'm not really sure VaginaVagina is all that secure of a password ....

Silly... try a leet password generator

That is just silly... I spend too much time trying to think of what these inkblots look like, and some of them really don't look like anything.

Try a leet password generator [goodpassword.com]... way easier to remember!

Who Watches the Watchmen?

Rorschach's Journal. December 5th, 2007:

OS carcass on a hard drive this morning, random characters across its boot sector. This internet is afraid of me. I have seen its logins in the clear.

The passwords are in dictionaries and the dictionaries are full of "password", and when the accounts finally are taken over all their mothers maiden names won't save them.

The accumulated malware from all their pr0n and Myspace visits will load up about their processors and all from Tron Guy to Chuck Norris will look up and shout "reset us!"...
 
...and I'll look down and whisper "NAK!"

R.

But....

can I make a mask with it?

A Word of Warning...

"But a word of warning, the story notes that Microsoft is collecting and storing users' word associations."

Well, that only makes sense. They can simply assign each association an index and store the index instead. A great space savings there.

To illustrate this principle, consider that they will now only need to store the assigned Id value (probably '1') to user's recorded association response "FUCK YOU" as one byte.

Then to further save on space, they'll use another compression technique, known as "Run Length Limiting" (or RLL) to save space by encoding the number of times that value has been recorded, which will be implemented in a bit of code along the lines of "For (Every_User) DO { ... }". So if they select prudent sizes for their integers, they can probably encode their entire response catalog in 5 bytes.

It look like spilled ink.

I don't think I pass the raw shock test

They all look like cats to me!

No, that one's a dog...

IDGI. Why are they using cat captcha to front end this?

There's no way a screen scraper is going to be able to get past the password selection.

This is not a useful design.

First, it doesn't matter that they're storing associations, what they're storing is the first and last letters of the association, for 10 associations.

Second, I don't think even Richard Feynman would be expected to get past the password selection process.

* The inkblots don't really remind me of anything. I guess I haven't done enough psych tests or something, but they all look like masks to me, and "mkmkmkmkmkmkmkmkmkmk" is probably not a good password.

* You have to come up with the *same* associations over and over again?

I fail this test, it would be easier to simply memorize a random string of letters.

Re:use password agent to store all your password

I am reminded of an article involving the defeat of password theft via keylogger. The process involves cooking up an already strong password, but incorporating mouse clicks to relocate the cursor in the password as part of the deal... I.E....

"asdf$1234" is your chosen "strong" password, but after typing "asdf" you click the cursor after the second character, "s" and continue from there, leaving as$1234df. Since mouse clicks are not (typically) recorded by keyloggers, you would frustrate attempts to steal your data in that way. You could incorporate as many cursor moves as desired, should incorporate as many as practical, and it could all theoretically become part of the "muscle memory" discussed by other posts.