Winfrasoft touts pattern-based password alternative

Hmm...

So even if someone see's your keystrokes they cannot reverse the password.. ok. it might work.

but is changing your password as easy? a new pattern to remember every month could be problematic.. then again maybe not...

Er,

Have you seen how quick a computer can solve a sudoku?

Not a good idea

Shoulder surfing

I've had a fair bit of success with shoulder surfing in the past. Working on phones I often needed to get from one part of a building to another then back again and so on. Frequently there were coed locks on doors and I never tired to watch what numbers were used but how the patterns went - even on the ones with a litte raised bit to block sight of finger tips. It was due to having to wait for ages each time and also getting staff pissed off at having to unlock doors for me - I discovered I could get patterns easily.

I've got a certain amount of dyslexia but I don't know if that has helped as I can't remember most number sequences anyway and my head has developed other ways of remembering them as tunes or patterns.

Maybe the developers need to check out if thier system works with other than 'normal' people.

Secure?

Hmm, it looks nice and user friendly, however...

A 6x6 grid is only 36 bits, so unless there's something else going on the 'secure' pattern is only as strong as a 4-5 character password, and the number of possible combinations is likely to be reduced by needing a certain proportion of the cells to be on or off to create memorable patterns.

Sounds like a numberised version...

..of Android's gesture-unlock function. That one works fine until there's the tiniest bit of moisture on a capacitive screen, then all your accuracy goes to shit until you wipe it off.

Still, could work.

Patterns

Ross Anderson's excellent book "Security engineering" has plenty of references in regards to patterns being recalled at higher rates than a string of characters. Having said that this approach would still be open to attacks as there have already been phishing attacks which take a screen capture of 20-30 pixels around the "clicked" area, thereby placing where the click has occurred in the grid.

As others have said already, a six by six grid doesn't really produce a great number of combinations.

If there is an advantage it would be a lower number of password resets so reduced helpdesk costs, but I don't see an improved added-value from a security perspective + the obvious measure of explaining to people how this "new" technology works. Most people are comfortable with passwords now... getting them to actually design and pick "strong" passwords is one of the main issues so you'd come across the same issues (people designing "easy" patterns to remember).

Yes but mostly No

As a color-blind person who spends his free time, colour coding wikipedia tables I can attest that the colour don't cause issues. That's because they are on large enough swathes and with significant enough tonal differences that even a completely coloublind (very rare; most of us have trouble differentiating red/green hues) wouldn't worry about it.

And having the numbers duplicate along the grid makes identification harder.

However, how long before 90% of the peoples' patterns are a long enough straight line either on the first horizontal line or the the first vertical column?

And as a previous poster noted, don't try to change patterns regularly or it will be even worse than people recycling passwords.

Is there any knowledgeable security/encryption expert who could explain to me why do all systems start with the goal of un-doing mental patterns and habit evolved over millions of years? Let's face it the human tendency is always for a single sign-on approach. (Have just the one password, no matter how difficult or long). When all studies identify human factors as the no.1 vulnurability it's amazing that such systems have not adapted to accommodate this.

Android swipe

I like my Android pattern unlocker as well.

However,.for our admin passwords, we use the 10 word pass phrase approach.

for bank pin, I like the idea of displaying four faces you know amongst give strangers them you tap the faces you know.

Is this new?

Back in the stone age (the late '80s), my colleagues used to create passwords based on pattterns on the number pad. It's amazing how many people chose a simple guessable pattern - pretty much all start at top left (7) and ending at bottom right (3). Never took me more than 3 guesses to find their patterns and get access to their Systime accounts.....

I think some are misunderstanding how this works.

From what I can see the user does not click on the grid at all (so no problem for touch screens) but merely "mentally" traces their pattern on the grid and enters the appropriate numbers. This would go some way to eliminating shoulder surfing too (provided users don't move the mouse to remember) since if I used the number 1 it may be found in many squares of the grid so even someone seeing the numbers and the grid wouldn't know for certain what the pattern is.

[Incidentally this reminds me of the advice a few years ago to use the same digit twice in PINs since an attack to find the PIN would only return the digits used in a PIN but not their order or frequency. Does anyone know if that is still applicable?]

Err...

Someone should tell these guys about the disabillity discrimination act.

Are blind or partially sighted users supported? Those with tunnel vision? etc. etc