Tactile Passwords vs Shoulder Surfing 115
holy_calamity writes "Entering passwords using a tactile interface would remove two of the main vulnerabilities of using keyboards and alphanumeric passwords say UK researchers. They're using sequences of tactile icons on a VTPlayer tactile mouse instead. Shapes are displayed using the 16-pin tactile displays under the user's fore and middle fingers. As well as being almost impossible for anyone else to observe, tactile passwords can't be guessable in the same way as many conventional ones, they say. A video shows it all in action." Not that the video really helps explain it very well.
Impossible? (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
special tactile mouse needed .. (Score:4, Interesting)
Re:special tactile mouse needed .. (Score:4, Insightful)
Re: (Score:3, Insightful)
Actual pin is 1234
Standard keypad layout
789
456
123
The screen shows
251
369
847
You click on 8473. The next time round it's a different keypad layout.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Another good idea I should have patented
Re: (Score:2)
Are you allowed senior moments when you are only 41?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
That would make it very hard for an onlooker to read, especially with recessed displays.
Re: (Score:3, Interesting)
Another nice feature is that the numbers that are randomly displayed in different places are only visible when viewed straight on; so the guy standing next to you might see where your fingers go, but he won't see what number was displayed on that key at that time.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2, Insightful)
I can't help but think that it would take too long to find each individual key. I suppose they could just display the numbers that are in your PIN and perhaps put them in the correct order so that it would be easier to find them.
Why dont they ask for just 2 or 3 numbers from your PIN, like the way they do on online banking systems? Works well for me...
Re: (Score:2)
Actual pin is 1234
I don't know that.
Standard keypad layout
I know that.
The screen shows
251
369
847
I can see that.
You click on 8473.
I see that.
The next time round it's a different keypad layout.
But that doesn't matter, because the first time round I mapped 8473 to 1234 in my head as I watched you do it.
This is security through obscurity; it relies on one or both of:
1) me not realising that the keypad represents the "normal" numeric keypad, mixed up
2) me not being able to perform
Re: (Score:2)
Well, yea, the method fails the logic test. Another poster mentioned a real keypad that scrambles the numbers. With a shield around the keypad then I would assume that shoulder-surfing wouldn't work.
Re: (Score:2)
Re: (Score:2)
so you are presented with a grid of letters over nine boxes about three in each box. and you click your letters...
asteriks appear in the box- what they represent, a shoulder surfer couldn't know.
if my pinword is "spaghetti" then I click boxes to follow that word, next time- it'll be different boxes.
Re: (Score:1)
TFA says that they're looking into using it for ATM machines. An image on an ATM machine would be considerably less secure than a keypad type device.
Re: (Score:2, Funny)
good god it's brilliant!
they could be connected via Network Interface Card cards!
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Ok, It was just a suggestion, the idea probably needs a little more work. How do the visually impared use the VTPlayer when they have to
"a user moves the mouse over a grid of nine blank squares displayed on a computer screen"
Re: (Score:2)
Re: (Score:2)
That pretty much cuts out shoulder surfing since the ATM can communicate with you and only you.
One possible scheme would be that the ATM would tell you via a tone if the next character should be legit, or bogus. Bogus ones would be ignored, the legit ones would form your PIN. As long as the order and frequency of the legit vs bogus keys were sufficiently random, knowing the digits and order wouldn't make a difference.
Re:special tactile mouse needed .. Blind people (Score:1)
Re: (Score:1)
Onscreen keyboards have already been defeated.... (Score:2)
http://www.boingboing.net/2006/09/18/onscreen_bank site_ke.html [boingboing.net]
"The novelty of this trojan lies in its capacity to generate a video clip that stores all the activity onscreen while the user is authenticating to access his electronic bank.
The video clip covers only a small portion of the screen, using as reference the cursor, but it is large enough so that the attacker can watch the legitimate user's movements and typing when using the virtual keyboard, so that he gets the username and password
Optimus Keyboard (Score:1)
Might be perfect for such a situation, with a firefox extension to change the keys.
Re: (Score:1)
Re: (Score:1)
Example:
1 2 3
4 5 6
7 8 9
map:
P G M
R C W
Q Y K
Note these are together on the same icons.
If my pin is "12345", I can click the icons with my mouse, or enter in "PGMRC" into a text box. You are not allowed to enter numbers in the
How could the video explain it? (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
And youtube (Score:1)
Re: (Score:1)
Re: (Score:2)
Oblig: YouTube is not like a truck you can just dump a bunch of video on.
How do you figure that the demand on one boring nerdy video at 8:35am EST Monday is going to somehow be more than the demand for five thousand videos of a pair of mock-slutty half-drunk teen girls singing Britney songs in their kitchen, viewed at 8:35pm PST Thursday evening?
Re: (Score:2)
Link please. I've got to see this.
Too easy (Score:2)
Okay, I dunno if they're half drunk, but they are two mock-slutty girls singing a Britney song.
What do you expect? I just did a youtube search for britney lip sync. You'd be surprised how many guys lip sync to Britney Spears; I had to scroll down pretty far.
Er... (Score:3, Insightful)
Cool though this tech is, there is nothing so clever that fools can't render it worthless.
Augmented shoulder surfing (Score:1)
However, with the arrival of smaller and smaller video recorders, this could indeed be a decent solution for those forced to use passwords at terminals in (more) public places.
Though, the smaller entropy pool would likely become a problem if measures aren't taken to counter brute-force attacks...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
However, if you did manage to break a finger (or even end up with an arm in a sling for a while) it would be a royal pain if you didn't have a backdoor.
Personally, whenever coming up with an "inventive" password entry scheme, I always leave a second way in, a long complex password I memorize the way to reconstruct it, but never use, so it can't be o
Re: (Score:2)
Re: (Score:2)
I always pay attention at ATMs and public terminals. I've noticed that 1) most people make absolutely no effort to hide their keystrokes and 2) most establishments make no effort to hide the little pad people use to enter their passwords or PIN. The absolute worst are those internet cafes that put people with their backs to a street-facing window so
Typical IT response: blame the user. (Score:2)
Or maybe there are no simple solutions, but people that are not familiar or comforatable with IT should not be denigrated for solutions that are clearly inadequate, difficult, or both.
Re: (Score:2)
Re: (Score:1)
Shoulder surfing? (Score:4, Funny)
I ended up typing my passwords a few times in notepad and memorized the gibberish that is my password now. Other than that I'd have to be trying to know what my fingers are pressing when i go into password mode.
Re: (Score:3, Insightful)
My personal password policy: I have four kinds of passwords. The highest and most secure ones are for the work accounts and my financial institutions. The next ones are for the web merchants who know my mailing address and credit card numbers
Re: (Score:2)
Re: (Score:2)
not enough bits (Score:1)
Re: (Score:1)
Re: (Score:1)
Obviously, having more squares reduces the chance of succesfully guessing the password, but scanning lots of squares with a tactile mouse will take for ever.
The best solution I can think of is to have only
Re: (Score:1)
So for each try you always have 1/9 chance to hit the jackpot, no matter how many times you try.
With this system, the number which you should compare to the 8 bits character for traditional passwords would be the number of tactile patterns your finger is able to recognise (at least as many as braille characters ?) This number would then be multiplied by the number of patterns you have to recognise (4 in their experimental set-up).
Re: (Score:1)
I must say, however, that this will be quite time consuming. I'm not sure if the boxes reset after every
Yet again something that won't work for everyone (Score:1)
Nice approach (Score:2)
Sort of like killing a fly with a bulldozer.
Conflict (Score:2)
I suppose the solution to this paradox is that the tactile mouse will display pointer only during tests, and in actual situations nothing will be observable.
That could make it hard to quickly enter a password even if you know it.
-------
The biggest flaw of this method is that it does nothing for keyloggers. Yea, maybe if your boss wants to know your password
Re: (Score:2, Insightful)
In actual situations, as the name "tactile" suggests, the user's fingers will lay on the pads, so nothing will be observable.
Crazy idea (Score:1)
Re: (Score:1)
That'd be the Optimus. I like it for the simple fact of not having to poke around trying to learn where the keys are when typing in foreign languages. It makes doing much easier. That being an example. was the only of the 3 letters that I found without 5+ attempts.
The gamers I know like it because they said not all games follow the standard commands (e=enter...I think?), so having them change on the keys depending on the game would make it easier. I
Re: (Score:1)
http://www.artlebedev.com/everything/optimus/ [artlebedev.com]
And once again... (Score:1)
My Solution (Score:3, Funny)
Then all you have to do is stick something in the hole to donate a blood sample.
--
Stupid people breeding has lead us to the current government
Re: (Score:1)
You just put down the red carpet for the one-liners...
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Don't give me any of that "oh we'll just use it for logging in purposes" either!
Mmm.... tactile.... (Score:3, Funny)
Re: (Score:1)
A tactile mouse shaped like.. you guessed it.. a breast.
Easier solution (Score:4, Interesting)
I've seen countless stories about dedicated password-entry hardware, but none of them (with the minor example of insecure fingerprint scanners) have made an impression. Purpose-dedicated hardware rarely does.
Re: (Score:2, Funny)
You sir are correct, this is the way to go when creating a password.
Me, I have yet another layer of protection : my keyboard is labelled in standard French Azerty, but I use a french Dvorak layout (I have no need to change the labels since Dvorak layouts are designed for touchtyping).
It's very funny when the co-workers try typing stuff with my keyboard :) For example, this is "Hello, World!" typed as if my keyboard was Azerty :
(funnily enough, that's also "Hello, World" in Gaelic.
Memory. (Score:1)
Imagine these at a job where you're forced to change codes regularly.
Re: (Score:1)
Oh, I shouldn't said that!
And the time wasted ? (Score:2, Interesting)
> On average, the volunteers took 38 seconds to log on
So now I need about 4 to 5 seconds to log on. (Just tested it)
Considering that the system needs a special mouse and a special login interface, too, why not get a mouse with a finger print reader and use that login interface?
I would also imagine Joe User will be trained faster to "put your finger there, dude", then to feel and remember the tactile pattern.
Re: (Score:2)
Won't work. The whole point, I think, is that the grid changes, but the code stays the same. Therefore, you can only tell where the "key" is by touching it. This is also why it's immune to shoulder surfing.
Fingerprint (Score:1)
Got rhythm? (Score:4, Funny)
Re: (Score:2)
As a radio amateur (old school, 20 words per minute Morse), I would be very happy to key in my password entirely on the "J" key.
But then every Rush fan in the world would have the same password: -.-- -.-- --..
Re: (Score:1)
why are we still using one/two factor authenticati (Score:2)
Make sure though the fingerprint key is not stored on the card
Quick & easy passwords (Score:2)
ps -A |md5sum
This will ALWAYS give you a different result, and it is not reproducable/predictable.
*Windows users need not apply
Now, to 'remember' is a different story. I'll let you figure out your own method.
password will be too long (Score:2)
When memorizing a password, I think length is more important than the number of possible symbols at each position, when it comes to difficulty of memorizing. Memorizing 10 decimal digits is easier than memorizing 32 bits, for example.
Conversation stops shoulder surfing (Score:3, Interesting)
Talk to the person, and look them in the eye while you type your password.
Not gonna work for all situations (ATM Pin) but incredibly effective where there is only one person who really presents a risk, and really, how often are you working in a crowd?
OK, Classrooms just suck, so you have to rely on flying fingers sometimes, but I did find it to be useful when "that kid" was hanging around the same way. "That kid" could be a proto-geek, or a hacker wannabe, but I always did what I could to educate and make conversation. Hey, you're interested? Cool! Kids (even teens) respond really well to being treated like people. And, the conversation made it easy to type my password without _him_ seeing it. No need to tempt 'em.
Shield (Score:2)
Wall (Score:2)
My solution... (Score:2)
BTW: If anyone finds such a technology let me know. I need this for what I'm surfing slashdot at work too.
Parent is so self confident... (Score:2)
Re: (Score:1)
Re: (Score:1)