Microsoft Research has just launched a new Web site InkBlot, which shows, a series of Rorschach Inkblots and helps users create a secure, personal password that is easy to remember. The user is presented with a sequence of random inkblots. Each should remind the user of a word, a butterfly or a pumpkin, for example. For each image, the user then types the first and last letters of the word that come to mind, such as 'by' for butterfly or 'pn' for pumpkin. InkblotPassword.com currently has 1,000 inkblots in its database.
Passwords almost always suffer from one or more serious problems. Users have a difficult time remembering strong (high-entropy, hard to guess) passwords. Users handle this difficulty by recording their password somewhere insecure, by selecting a weak but memorable password, or by using the same password at multiple sites. You can also learn more about the principles behind inkblot passwords in this Microsoft Research technical Report MSR-TR-2004-85.
One question which comes to mind, is that if the site is saving the word associations, does it mean that it is saving your password too ?
Link: InkBlot
News source: WinVistaClub
Passwords almost always suffer from one or more serious problems. Users have a difficult time remembering strong (high-entropy, hard to guess) passwords. Users handle this difficulty by recording their password somewhere insecure, by selecting a weak but memorable password, or by using the same password at multiple sites. You can also learn more about the principles behind inkblot passwords in this Microsoft Research technical Report MSR-TR-2004-85.
One question which comes to mind, is that if the site is saving the word associations, does it mean that it is saving your password too ?
Link: InkBlot News source: WinVistaClub
Then again, I suppose Microsoft could see your .NET Passport password if they wanted, and that's a deployed service.
if they wanted it badly enough, they would bruteforce it, and a cluster of there servers would do that very fast
Nice.
But really can't see it helping to create stronger passwords. If the pictures are visible then other people could see the same word in the pictures. All you need is the username to access that user's sequence of pictures.
How many people would think butterfly for this one?
http://static.inkblotpassword.com/BlotImages/blot0708.png
Also, what happens if the picture's meaning changes to you. In a space of 5 minutes, I can't remember what word I originally thought of for some of the pictures and now can't login after serveral tries. The pictures are too vague.
Did I think of two doves, some flags, dancing people for this one?
http://static.inkblotpassword.com/BlotImages/blot0184.png
Maybe I got something wrong as I'm just confused by it. The way I see it is that it would be better to remove the picture-word association from the system. Users should select their favourite images from a selection of pictures.
Last edited by pjak on 10 Dec 2007 - 07:53
Oh, by the way:
Microsoft Research will study the usage patterns of users of this site, to help us evaluate the inkblot password scheme. We will have access to the passwords and lists of OpenID consumer sites accessed by users of InkblotPassword.com. We will do our best to preserve the privacy of users of the site. However, we will report on our studies, including aggregate or anonymized versions of the data we have collected.
Privacy issues aside, I can see why it is necessary to have information about a person's password - you need to see whether people really do see different things in the blots, or else the system won't work.
However, my password will now be all be: bt bt bt bt bt bt bt bt
Coz I saw.
Bat
Bat
Another Bat
errr, a group of bats
bat wearing a tuxedo
oh and there was one turtle. But it could have just been a green bat.
So I am either crap at making up passwords or have no imagination
That aside, the sign-up box on inkblotpassword.com looks like a Scottish thistle painted by a 2yo with lumps of potato. Unfotunately that then equates to, that's right, an inkblot.
The use of the first and last letters raises an issue: whilst you can have a very strong password with seemingly random characters, words have a very small subset of permutations, and first and last letters of those words even more so. I can't think of a word that ends with "j" or "q" (proper nouns excepted), so that further reduces the subset.
I never did fully wrap my head around that book, and the movie just plain stank!
So, with a little bit of research, isn't it feasible to assume that someone could get a big list of the most frequently picked associations with the various inkblots and thus narrow down their results considerably?
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.