Child-Suitable Alternatives To Passwords?

An anonymous reader writes "Two months ago I donated my old PC to my little sister, who is 7 — I had promised she would get her own computer as soon as she can read and write properly. I then proceeded to answer her questions about how it works, as far as she inquired, and tried to let her make some choices when installing Debian (she can already use GNOME). As I explained password protection and encryption to her, I was pleasantly surprised when she insisted on protection measures being as strong as possible, so that no one else can screw with her computer. She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent. The significant problem is that she cannot permanently memorize abstract passwords, even if they are her own creation. I talked with a teacher who assured me that this is common at her age. My parents would probably be able to guess non-abstract passwords. What mechanism of identifying herself does the Slashdot crowd suggest?"

Fingerprint Reader?

Would a fingerprint reader be suitable?

Re:Fingerprint Reader?

A fingerprint reader wouldn't work. Fingerprint reader software (such as the wonderfully open source ThinkFinger) map out a fingerprint by locating easily identifiable marks, such as swirls or dead-ends, and map their proximity to other easily identifiable marks. As this girl is seven its fair to assume that in a few more years her fingers will be twice their current size.

The fingerprint will be the same, but scaled up so all proximity will be lost.

Re:Fingerprint Reader?

Wow... Are we talking about the DoD here or a 7 year old girl's computer... IMO a seven year old does not require digital privacy in thier home.

That being said just use a sticky note hidden somewhere or something. Or use a non-abstract password, like her favourite food, or least favourite food. How long would it take you to guess "fudgeicle"?

And, it's already been mentioned that the parents persumabally have physical access to the computer, and if they have the know-how and confidence to install some sort of parental control into a linux distro, then the password is not going to be a problem for them to bypass.

passphrase

Teach her to use passphrases, something like 'My favorite food is steak'. This is something that's easy for her to remember and also hard to break just from the sheer size of the password. When she's old enough, she'll figure out how to make hard passwords on her own; just give her a few suggestions about capitalization, numbers and symbols.

To Deal With Size Limitations (Variant on Phrase)

Naturally as humans, we are very capable of memorizing lyrics, poems, quotes & the like from our favorite media. I've suggested this before and I'll suggest it again. Pick something that your little sister loves, like pokemon, Harry Pothead, Celine Dion or whatever the devil kids are watching/reading/listening to these days. And simply have her pick the most memorable quote or verse from that thing. Then you simply strip down to the first letters of each word (punctuation and capitalization included) and you have something that is easily memorized but fairly random.

For instance, in high school I listened to Tomorrow Never Knows off of the Revolver record by The Beatles nonstop. Since I know every lyric [lyriki.com] of that song, I might pick the opening line:

Turn off your mind, relax and flow downstream

Which would render the password:

Toym,rafd

Not a bad password, in my opinion. You could do the same with the opening line of a book, quote from a movie, TV show or even a line from a poem. All of these things are very memorable and produce hard to break passwords.

Re:To Deal With Size Limitations (Variant on Phras

"provides a simple solution we ordinarily remember? done!"

Re:passphrase

Memory... a seven year old's is quite fluid. "My favorite food is steak" might morph into "My favorite food is ice cream" or "I like steak" or "I like eating" or "I like my little pony". Passphrases might be easier than g%jP22094jmqqlDMSk, but they're still memory-based.

Re:passphrase

g%jP22094jmqqlDMSk

Hey! That the combination on my luggage!

Shape

Have her make a pattern on the keyboard that she can remember. I've actually had a number of PIN codes that I didn't actually remember apart from the pattern they make on the numeric keypad.

Strange quote...

My parents would probably be able to guess non-abstract passwords.

I find this interesting. Is the goal to set up a machine for a 7-year-old that parents cannot access? If so, I personally think this is silly. I do admit I RTFS very quickly and perhaps missed something.

Re:Strange quote...

My parents would probably be able to guess non-abstract passwords.

And exactly why is this a problem? If your parents are totally and completely incompetent, go to child protective services now, for you have more important issues than passwords.
Otherwise, quit undermining your parents and let them raise your sister. You can contribute if you want by teaching her about computers, but do it in assistance to your parents, not in opposition.

Re:Strange quote...

This can be solved by giving the parents the root password and letting the girl keep a secret password. That makes it so that she gets the feeling of privacy and, for the most part, the reality of privacy while still allowing the parents to do and see whatever they want on the computer.

Re:Strange quote...

I noticed the same thing. Also the quote how the brother had to "endure" parental control software. We're talking about a 7-year old. There should be parental supervision, education, and monitoring.

Re:Strange quote...

There should be parental supervision, education, and monitoring.

Why?

Two reasons. First, parents are completely responsible for their child's safety. That includes things like giving out her name, address, even state to strangers. Perhaps it's a surprise that children... even kids twice her age, do not tend to use good judgement.

That judgement is learned, generally through the parents. And yes, you'll see lots of adults using their parents' poor judgement.

The second reason is that it helps prevent parent ignorance. If the parents participate in her "computer experience" they will become experienced, too. The younger kid had to endure safe-surf software because the parents didn't want to surf with the kid.

What gets me is that a 7-yo actually feels the need to hide things from her parents. This can be from watching her brother and deciding his frustration was bad, or it could be because she doesn't trust them so much.

Re:Strange quote...

I agree. At that age, her dealings with computers (particularly computers with Internet access) should be closely monitored by her parents. She should set up a password and be instructed not to tell other people what it is in order to get her into the habit of good security practices, but her parents should nevertheless know the password (or some other way to access the computer).

Of course, my son is 8 and he's only allowed to use the computer in the living room, and we can easily see what he's doing on it at all times. Kids are already going to obsess about keeping things from their parents when they're teenagers, there's no reason to start building that barrier when they're only 7.

Re:Strange quote...

Thank you to all who have pointed out that perhaps locking the parents out is not a sensible goal. While I think it is good for a child this age to understand the concepts of security and privacy, I don't think that it is reasonable for a minor to expect her own little private computing world, free of parental control. There should be some semblance of openness and trust in a healthy household, particularly between parents and their children.

at age 7

I would suggest the parents have the root password, and their child can ask them to reset her password when she forgets.

Parents guessing the password of a seven year old is ridiculous, is this a serious question ?

Why keep her parents off exactly ?

Seriously, she's 7?!

I have two daughters around the same age. They share a computer that we gave them for xmas. They have their own accounts, with their own passwords and my wife and I maintain the Administrator account. I could not fathom them having an Internet-accessible computer without us having full control over it.

Am I missing the point ? Because when I read:

"My parents would probably be able to guess non-abstract passwords"

it sounds to me like you're trying to keep a 7 year-old's parents off of a computer she uses when they have every right (and reason / responsibility in this day in age) to know what their young child is doing on a computer.

Of course I am all for teaching kids how to be security conscious and protect their private data. But it's a fine balance. Parents need to keep themselves in the loop in order to, you know, be effective parents.

Why are you trying to undermine your parents?

With phrases like "She knows that my younger brother has to endure strict parental control software that was installed on his machine without his consent" and "My parents would probably be able to guess non-abstract passwords" you are clearly trying to undermine your parents. I know that children, though you don't give your age, usually think that they know better than their parents, but guess what: it isn't usually true! I hope that your parents are smart enough to take your sisters computer away if you succeed in locking them out.

Use a passphrase...

...like, "My parents are responsible for me." Or, "I live under their roof, so I play by their rules." Or, "My brother is an asshat."

And yes, I'm a parent.

Child-Suitable Alternative To Car Keys?

I have a seven-year-old child who needs to drive around town in a car, but has problems getting the keys. Is there anyone on Slashdot who has suggestions on how to open, start, and operate a car without keys and otherwise make it so easy even a seven-year-old can do it? Thanks! Signed, A Responsible Human Being

Re:Fingerprint?

A fingerprint seems like a reasonable idea. If she's just trying to keep other family members off of it, rubber-hose cryptanalysis is unlikely to become a problem

You were an only child, right?

Re:Pictures

Yes, and I'm questioning two aspects of that:

Why the parents need to be kept out, and why the AC thinks that any password will keep out parents who presumably have physical access to the system.

If the parents are taking an interest in keeping young children safe, then by all means let 'em.

Re:Pictures

Is it not, after all, a fundamental not only on Slashdot but of security in general that any security can be broken if you have physical access to the boxen?

In any case, I think as a primary corollary to your first question, one really needs to ask whether this is a decision that the submitter should be making with his sister. It seems to me, that with all of the talk on Slashdot about 'we must blame the parents who do not take care of their children', this is a decision the parents need to make with their daughter (or that she needs to make alone and can then argue with them afterwards about).

It seems like a ripe situation for family conflict when the (brother, presumably) interposes himself as he is doing here.

Re:Pictures

You nailed it.

As a parent, there's no way in a hell a 7 year old will have a lock down to keep mom and dad out, no responsible parent will allow such a thing, and the machine gets taken away if such a practice is put into place.

When your 18, go right ahead and make the 53 ch4R@ct3R password to lock your machine up, until then, accept the fact that you are the child and we are the parent, and you don't get root access or personal and private encryption, you ask the IT department (dad).

Cheers.