Dummy Cursors Keep Your Passwords Safe

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Get a load of this password protection system. I think I like the circle idea best, the other one just looks like a swarm of bees. ;)
 
why would you use a mouse cursor to punch in a numerical password on a big fucking keypad with a computer screen in the first place?
 
Or..you can just get a privacy screen. Or better yet, type in your password using both your hands instead of one finger and few are likely to be able to follow your fingers anyhow.
 
It was hard to point figure out which cursor was the real one. If you're trying to get people to stop looking over your shoulder, then maybe virtual glasses maybe a good idea. Won't stop screen captures or keyloggers, but good web surfing practice would easily prevent this.

myvu-crystal-eye-glasses-video-monitor-for-ipod-and-iphone.jpg
 
Given that they're worried about screen caps and key loggers, a video recorder would be able to determine which cursor was real.

The "fake" cursors must move to either a semi-random or algorithmic pattern. The real cursor's movement is unconstrained.
 
Pfft.

Ernie: My passwords are safe, thanks to these 20 other cursors!
Burt: Google Glass, enhance picture. Stop. Now zoom in on the reflect, center....stop. Enhance. Stop. Record video entry.


Yea, something like that.
 
Zangmonkey said:
Given that they're worried about screen caps and key loggers, a video recorder would be able to determine which cursor was real.

The "fake" cursors must move to either a semi-random or algorithmic pattern. The real cursor's movement is unconstrained.
Click to expand...
Yep. Even if one couldn't determine the algorithm governing the fake cursors' behavior, the user would have to be trained to "swirl" the real cursor around, clicking when the cursor passes over the right numbers. Otherwise, the real cursor will be discernible because it will be making purposeful movements (and they'd become more obviously purposeful with repetition) from button to button.

Far better to use passwords entered by keyboard - hopefully with the option to have passwords up to as many as 100 characters - and then add further security by randomizing the number of asterisks generated with each keypress so that an observer won't even be able to figure out how many real characters make up the password. Hunters/peckers will still be at increased risk but it puts the user's whole body between a human observer and the keyboard, and it limits significantly the useful angles for remote observation.
 
Babbster said:
Far better to use passwords entered by keyboard - hopefully with the option to have passwords up to as many as 100 characters - and then add further security by randomizing the number of asterisks generated with each keypress so that an observer won't even be able to figure out how many real characters make up the password.
Click to expand...

Complex passwords don't mean a damn thing when it comes to key-loggers. Although software could keep track of the cursors position when the mouse button clicks anyways...

Eh, Yubikey FTW.
 
melteye said:
Complex passwords don't mean a damn thing when it comes to key-loggers. Although software could keep track of the cursors position when the mouse button clicks anyways...

Eh, Yubikey FTW.
Click to expand...
True, but I was addressing only the visual aspect which, as you note, is all that the subject software addresses. One shouldn't install keyloggers in the first place, of course. ;)
 
Babbster said:
True, but I was addressing only the visual aspect which, as you note, is all that the subject software addresses. One shouldn't install keyloggers in the first place, of course. ;)
Click to expand...

On-screen keyboards are commonly used to circumvent key-loggers... this software would serve the same purpose while lessening the risk of observers finding your password.

I'll be sure to tell thieves that they shouldn't install keyloggers on fellow employees/peoples machines :p
 
bigddybn said:
Pretty common defense against key loggers.
Click to expand...

In Ragnarok Online, the keypad numbers even move around so even a packet sniffer wouldn't be able to get the password.

Keyloggers are rampant in internet cafe's even with the owner doing nightly restores.
 
Even in that video I was starting to see patterns. I got the last three digits, 825, entered at one minute. That was with 15 cursors, that guy trying to be sneaky, and me having never seen the tech before.

Get someone who is better at recognizing patterns than I am, give them a little time, and pretty soon they'll spot the real cursor every time. Like this guy: http://www.youtube.com/watch?v=UN0LvFZMKq8

Still, better than Apple making me enter my password to install an app when it's totally obvious to anyone watching what I'm putting in. Can't install anything in a public place.
 
Zangmonkey said:
Given that they're worried about screen caps and key loggers, a video recorder would be able to determine which cursor was real.

The "fake" cursors must move to either a semi-random or algorithmic pattern. The real cursor's movement is unconstrained.
Click to expand...
You could have some of the fake cursors mimic the real cursor but turned 90 degree or mirrored for a short period of time. You could also have some fake cursors intersect the real and other fake cursors so that the cursors are perfectly merged. Then have them diverge slowly from each other making following a specific cursor a nightmare.
 
sfsuphysics said:
why would you use a mouse cursor to punch in a numerical password on a big fucking keypad with a computer screen in the first place?
Click to expand...

Keyloggers.

You randomize the order of the numbers and the position on the screen. SO if they record mouse movements, they have recorded nothing useful. Then you do it all on screen with the mouse so you can't log keystrokes.

Do you not have online banking? Do they not do something like this, or give you one time use password tokens? If they don't you might want to bank elsewhere.
 
You must log in or register to reply here.
Back
Top