Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what you must do to your password during the login.

For example if my password was "password123" on the login page if I used that password it would not work. If you follow the message it might say something like add the letter "E" after the second letter in your password then add a "!" symbol at the very end. So a successful loging would require "paEssword123!". The requirements and complexity of the password alterations could vary greatly from one change to multiple changes to the types of changes. Every attempt would generate a new random set of password alteration requirements. So if they typed it in wong the next login might say capitalize the first 3 letters and lowercase the rest of the password, then add the number 5 in the second to last character spot (PASsword1253).

EDIT: You could not do capital/lowercase changes because since the original password is unknown the system could not strip out the alterations it asked for before testing the real password. But you could still do additions of characters.

Therefore (other then when they first created the password) their password is never entered into the website again as the exact password. So keyloggers wouldn't be able to just copy what they type in because the password would technically be different on every login attempt.

Granted if there was keylogging they might have 90% of the real password (depending on how much a user had to modify it during logins) but it still would make it much harder to guess and then write software that could read the rules of the captcha and alter the password (and they wouldn't even know what the real password is at this point) each time in a brute force attack.

Browser password saving or anything that saves passwords for you would not work, it would be little bit of a pain each time you had to login but if this was important data like bank information I would be willing to spend a few more seconds logging in for extra security, esp. against things like keyloggers.

Other then users having problems following the rules during the login, are there any other flaws to this idea? Does it sound like it would work or not work and why?

Thanks for your opinion.

share|improve this question
    
This doesn't protect you from a keylogger at all as most of them take screenshots quite often. They'd be able to see what you had to add to your password and remove the useless characters. –  Simon Jun 6 '13 at 16:51
    
@Simon Oh, in that case yes this would be pointless. I am not well versed in keyloggers I just thought they stored keyboard characters typed. So yes that would make this whole idea pointless then. –  Danny Jun 6 '13 at 16:56

2 Answers 2

up vote 6 down vote accepted

Interesting idea, but there are a number of reasons why this does not add as much security as you hope.

First, software based keyloggers typically have luxury of being able to not only receive what you type, but also see what you see. In particular, if a bank introduced such a system then a short while later malware would appear that logged what you typed and what the modification instructions were. This is an on-going arms race situation with banks and malware developers right now, which is why we have "please enter select the 2nd, 3rd and 7th character of your password".

Second, you'd also have to significantly increase the allowable number/frequency of incorrect password entries, making brute forcing easier.

Third, users typing in their password with this scheme would be much easier to shoulder-surf, as they would be typing their password much more slowly.

(The question already captures the fact that a keylogger would already have the majority of the password - any guesses what this user's unmodified password was? "PassQword1" ?)

I think you already capture the main downside - usability:

  • It wouldn't work with many password saving devices, encouraging you to use a simple password you could easily remember (and hence could easily guess).
  • It would frustrate and hence drive away users (unless it was ubiquitous - but early adopters would have to overcome this barrier).

Given the limited security benefit and significant usability impact, this scheme would probably not be widely adopted (which, of course, would increase the security benefits to anyone who did adopt it - there would be unlikely to be any malware designed to read the instructions; nor tools to reverse the modifications).

share|improve this answer
    
Thanks for the feedback. After this and what Simon said just about screenshots alone the idea doesn't work at all. Well just a thought glad I got that feedback so I didn't keep thinking if it would work or not. –  Danny Jun 6 '13 at 16:59
    
One more thought about shoulder-surfing: Too complex instructions will be difficult to fulfill, when you don't see what you are doing (because of the ******* in the input field). The alternative of showing the password will of course decrease security. –  martinstoeckli Jun 7 '13 at 7:23

Furthermore not adding too much security as stated, the changes to the current password systems to allow your mechanism would make the password management weaker.

Current systems doesn't compare your answer with saved password but they compare encrypted answer with encrypted saved password (the system is unable to know your raw password). This encryption can't be done backwards. If you could do it you would have a really weak system.

So when you add characters or modify your password, the system has no idea about how to compare the encrypted modified password with the saved one.

Remember the system doesn't know your original password, and so should be in order to maintain the security of encryption algorithms.

share|improve this answer
1  
It's not called encryption. They use cryptographic hashes which are salted first. –  Manish Burman Jun 6 '13 at 20:06
1  
The system wouldn't need to know the password, it would only need to know the modifications it asked the user to add. It would then remove the additions (if you said add 1 character to the end it would strip one character at the end) so you would be left with the original password to do the security checks against. Anyway as pointed out above this method would not really add any extra security anyway. –  Danny Jun 6 '13 at 21:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.