Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #489 > unrolled thread

Geographical passwords could solve the password catch-22

Back to article view | Back to comp.misc

Contents

  Geographical passwords could solve the password catch-22 "tdk" <forum.tdk@squte.com> - 2014-02-17 09:25 +0925
    Re: Geographical passwords could solve the password catch-22 Marko Rauhamaa <marko@pacujo.net> - 2014-02-17 19:08 +0200
    Re: Geographical passwords could solve the password catch-22 "tdk" <forum.tdk@squte.com> - 2014-02-17 17:52 +0000
    Re:Geographical passwords could solve the password catch-22 RS Wood <rsw@therandymon.com> - 2014-02-18 10:31 +0000
      Re:Geographical passwords could solve the password catch-22 dialmove <dialmove@gmail.com> - 2014-02-18 12:52 +0000
        Re: Geographical passwords could solve the password catch-22 RS Wood <rsw@therandymon.com> - 2014-02-18 20:01 +0000
          Re: Geographical passwords could solve the password catch-22 Tommy Mercer <txmercer@gmail.com> - 2014-02-18 21:22 +0000
    Re: Geographical passwords could solve the password catch-22 Whiskers <catwheezel@operamail.com> - 2014-02-22 17:51 +0000
      Re: Geographical passwords could solve the password catch-22 "tdk" <forum.tdk@squte.com> - 2014-02-22 12:48 +0000

#489 — Geographical passwords could solve the password catch-22

Geographical passwords could solve the password catch-22, says a security researcher.
Computer scientist Ziyad Al-Salloum of ZSS-Research, writing in the International 
Journal of Security and Networks, claims it's easier to remember places than numbers 
or words.

The system asks users to draw a boundary round a favourite place which is then hashed.

According to Al-Salloum  "Proposing an effective replacement of conventional passwords could reduce 76% of data breaches, based on an analysis of more than 47,000 reported security incidents," 
he explains that a whole-earth map might have 360 billion tiles at 20 degrees of 
"zoom," making geographical passwords essentially unguessable.

[1] "http://esciencenews.com/articles/2014/02/16/geographical.passwords.worth.their.salt"
[2] "http://xkcd.com/936/"

P.S. I assume there's some overlap between readers of this group, soylentnews and 
Slashdot, so I'm going to try to avoid posting stories already covered on those 
sites.

-- 
View this thread at http://squte.com/node/4490

[toc] | [next] | [standalone]

#492

"tdk" <forum.tdk@squte.com>:

> Geographical passwords could solve the password catch-22

Interesting. Essentially, this sounds as though the servers already know
everything about you when you connect so a password is redundant. The
ultimate antithesis of privacy.

> P.S. I assume there's some overlap between readers of this group,
> soylentnews and Slashdot, so I'm going to try to avoid posting stories
> already covered on those sites.

Why? Do you think those sites are going to return the courtesy?


Marko

[toc] | [prev] | [next] | [standalone]

#511

> Why? Do you think those sites are going to return the courtesy? 
It's a courtesy to regulars on this group, not the sites.

regards
~tdk
-- 
View this thread at http://squte.com/node/4490#comment-10477

[toc] | [prev] | [next] | [standalone]

#521

 "tdk" <forum.tdk@squte.com> Wrote in message:
> Geographical passwords could solve the password catch-22, says a security researcher.
> Computer scientist Ziyad Al-Salloum of ZSS-Research, writing in the International 
> Journal of Security and Networks, claims it's easier to remember places than numbers 
> or words.
> 
> The system asks users to draw a boundary round a favourite place which is then hashed.
> 
> According to Al-Salloum  "Proposing an effective replacement of conventional passwords could reduce 76% of data breaches, based on an analysis of more than 47,000 reported security incidents," 
> he explains that a whole-earth map might have 360 billion tiles at 20 degrees of 
> "zoom," making geographical passwords essentially unguessable.
> 
> [1] "http://esciencenews.com/articles/2014/02/16/geographical.passwords.worth.their.salt"
> [2] "http://xkcd.com/936/"
> 
> P.S. I assume there's some overlap between readers of this group, soylentnews and 
> Slashdot, so I'm going to try to avoid posting stories already covered on those 
> sites.
> 
> -- 
> View this thread at http://squte.com/node/4490
> 
> 

I'm having trouble figuring this one out.  The globe does provide
 more diversity of choice but I suspect most users would
 unconsciously choose a place they have a connection to.  Rather
 than choose some random mountain in Kyrgyzstan they are going to
 choose something familiar, and that provides an attack route when
 trying to crack their password.
-- 

[toc] | [prev] | [next] | [standalone]

#522

El Tue, 18 Feb 2014 10:31:54 +0000, RS Wood escribió:

> I'm having trouble figuring this one out.  The globe does provide
>  more diversity of choice but I suspect most users would unconsciously
>  choose a place they have a connection to.  Rather than choose some
>  random mountain in Kyrgyzstan they are going to choose something
>  familiar, and that provides an attack route when trying to crack their
>  password.

If the password system allows for arbitrary shapes, there's additional 
protection even if the user chooses his home or workplace as the pass-site.
There's no way to guess "my college campus, but just leave out the 
terrible cafeteria at Comp-sci faculty".

Of course, users should be educated to avoid using basic shapes like 
squares or hexagons, just as they now know to avoid using their birth date 
or a number sequence. Oh, wait...

[toc] | [prev] | [next] | [standalone]

#535

On 2014-02-18, dialmove <dialmove@gmail.com> wrote:
> El Tue, 18 Feb 2014 10:31:54 +0000, RS Wood escribió:
>
>> I'm having trouble figuring this one out.  The globe does provide
>>  more diversity of choice but I suspect most users would unconsciously
>>  choose a place they have a connection to.  Rather than choose some
>>  random mountain in Kyrgyzstan they are going to choose something
>>  familiar, and that provides an attack route when trying to crack their
>>  password.
>
> If the password system allows for arbitrary shapes, there's additional
> protection even if the user chooses his home or workplace as the
> pass-site.  There's no way to guess "my college campus, but just leave
> out the terrible cafeteria at Comp-sci faculty".
>
> Of course, users should be educated to avoid using basic shapes like
> squares or hexagons, just as they now know to avoid using their birth
> date or a number sequence. Oh, wait...

I'm remembering, too, that Americans (at least) have increasingly lousy
geography skills.  It was in the midst of the last Iraq invasion that
some researcher discovered a surprisingly high number of Americans
couldn't find Iraq on a map.  That's depressing.

I'm all in favor of a substitute for passwords, but we're not there yet,
and the new craze of fingerprint scanners doesn't yet seem to be an
improvement.

I'm waiting for "drop of spit" technology, where the sensor reads your
DNA to log you in :)

[toc] | [prev] | [next] | [standalone]

#540

On 2014-02-18, RS Wood <rsw@therandymon.com> wrote:
> On 2014-02-18, dialmove <dialmove@gmail.com> wrote:
>> El Tue, 18 Feb 2014 10:31:54 +0000, RS Wood escribió:
>>
>>> I'm having trouble figuring this one out.  The globe does provide
>>>  more diversity of choice but I suspect most users would unconsciously
>>>  choose a place they have a connection to.  Rather than choose some
>>>  random mountain in Kyrgyzstan they are going to choose something
>>>  familiar, and that provides an attack route when trying to crack their
>>>  password.
>>
>> If the password system allows for arbitrary shapes, there's additional
>> protection even if the user chooses his home or workplace as the
>> pass-site.  There's no way to guess "my college campus, but just leave
>> out the terrible cafeteria at Comp-sci faculty".
>>
>> Of course, users should be educated to avoid using basic shapes like
>> squares or hexagons, just as they now know to avoid using their birth
>> date or a number sequence. Oh, wait...
>
> I'm remembering, too, that Americans (at least) have increasingly lousy
> geography skills.  It was in the midst of the last Iraq invasion that
> some researcher discovered a surprisingly high number of Americans
> couldn't find Iraq on a map.  That's depressing.
>
> I'm all in favor of a substitute for passwords, but we're not there yet,
> and the new craze of fingerprint scanners doesn't yet seem to be an
> improvement.
>
> I'm waiting for "drop of spit" technology, where the sensor reads your
> DNA to log you in :)

It sounds like microsoft's picture password stuff attached to GIS data.

I'm not sure everyone wants to license and store all that GIS data just
to draw pictures on it.

-txm

[toc] | [prev] | [next] | [standalone]

#717

On 2014-02-17, tdk <forum.tdk@squte.com> wrote:
> Geographical passwords could solve the password catch-22, says a
> security researcher.  Computer scientist Ziyad Al-Salloum of
> ZSS-Research, writing in the International Journal of Security and
> Networks, claims it's easier to remember places than numbers or words.
>
> The system asks users to draw a boundary round a favourite place which
> is then hashed.
>
> According to Al-Salloum  "Proposing an effective replacement of
> conventional passwords could reduce 76% of data breaches, based on an
> analysis of more than 47,000 reported security incidents," he explains
> that a whole-earth map might have 360 billion tiles at 20 degrees of
> "zoom," making geographical passwords essentially unguessable.
>
> [1]
> "http://esciencenews.com/articles/2014/02/16/geographical.passwords.worth.their.salt"
> [2] "http://xkcd.com/936/"

I don't see how this is anything more than just another way of
generating a password; the user finds a place on the map and draws a
shape around it, various numerical parameters of the latitude
longitude and shape drawn are combined according to some formula, and 

,---- [  ]
| Once created, the password is then "salted" by adding a string of hidden
| random characters that are user-specific and the geographical password
| and the salt "hashed" together. Thus, even if two users pick the same
| place as their geographical password the behind-the-scenes password
| settings is unique to them.
`----

So we're back to a string of characters stored on a server, which has to
be matched with another string of characters supplied by the user's
computer.  The security of the password has nothing to do with how
complex or obscure the selection process was, only with the difficulty
of guessing or acquiring the string of characters actually used.

It isn't clear from the linked article how the user is required to enter
the password each time they want to access the protected data or
service.  If they have to use the same map and pick precisely the same
spot and replicate the shape they drew around it the first time, the
system will have to include a fair amount of leeway for inaccuracy in
those actions - and there will be a lot of data being exchanged and
possibly intercepted each time.  Both those aspects compromise security.

If the user merely has to store the final character string and
retransmit it when required, then anyone who can access that store has
immediate access to whatever the password is protecting - we're back at
the note taped to the back of the mouse pad, in effect.

> P.S. I assume there's some overlap between readers of this group,
> soylentnews and Slashdot, so I'm going to try to avoid posting stories
> already covered on those sites.

That may be a false assumption.

-- 
-- ^^^^^^^^^^
--  Whiskers 
-- ~~~~~~~~~~

[toc] | [prev] | [next] | [standalone]

#720

> I don't see how this is anything more than just another way of generating a password;
Yes, that's all it is. The argument is that since memory is a limiting factor for 
the 'guessability' of passwords, and people remember places better than words, 
this will lead to better passwords.

> the password is then "salted" by adding a string of hidden random characters that 
> are user-specific
I didn't understand this. Salts are used to prevent pre-compiled dictionary attacks 
and are old news; I suspect the writer was just confused about what was new.

> a lot of data being exchanged and possibly intercepted each time
Well that�s a potential problem whatever kind of password is being transmitted to 
the server. A bigger issue is that the user will have to send data to a third party 
server (say google maps), and shoulder surfing will be easier.

regards
tdk

 
-- 
View this thread at http://squte.com/node/4490#comment-10793

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web