Password on login idea

Question

In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what you must do to your password during the login.

For example if my password was "password123" on the login page if I used that password it would not work. If you follow the message it might say something like add the letter "E" after the second letter in your password then add a "!" symbol at the very end. So a successful loging would require "paEssword123!". The requirements and complexity of the password alterations could vary greatly from one change to multiple changes to the types of changes. Every attempt would generate a new random set of password alteration requirements. So if they typed it in wong the next login might say capitalize the first 3 letters and lowercase the rest of the password, then add the number 5 in the second to last character spot (PASsword1253).

EDIT: You could not do capital/lowercase changes because since the original password is unknown the system could not strip out the alterations it asked for before testing the real password. But you could still do additions of characters.

Therefore (other then when they first created the password) their password is never entered into the website again as the exact password. So keyloggers wouldn't be able to just copy what they type in because the password would technically be different on every login attempt.

Granted if there was keylogging they might have 90% of the real password (depending on how much a user had to modify it during logins) but it still would make it much harder to guess and then write software that could read the rules of the captcha and alter the password (and they wouldn't even know what the real password is at this point) each time in a brute force attack.

Browser password saving or anything that saves passwords for you would not work, it would be little bit of a pain each time you had to login but if this was important data like bank information I would be willing to spend a few more seconds logging in for extra security, esp. against things like keyloggers.

Other then users having problems following the rules during the login, are there any other flaws to this idea? Does it sound like it would work or not work and why?

Thanks for your opinion.

Answer 1

Interesting idea, but there are a number of reasons why this does not add as much security as you hope.

First, software based keyloggers typically have luxury of being able to not only receive what you type, but also see what you see. In particular, if a bank introduced such a system then a short while later malware would appear that logged what you typed and what the modification instructions were. This is an on-going arms race situation with banks and malware developers right now, which is why we have "please enter select the 2nd, 3rd and 7th character of your password".

Second, you'd also have to significantly increase the allowable number/frequency of incorrect password entries, making brute forcing easier.

Third, users typing in their password with this scheme would be much easier to shoulder-surf, as they would be typing their password much more slowly.

(The question already captures the fact that a keylogger would already have the majority of the password - any guesses what this user's unmodified password was? "PassQword1" ?)

I think you already capture the main downside - usability:

• It wouldn't work with many password saving devices, encouraging you to use a simple password you could easily remember (and hence could easily guess).
• It would frustrate and hence drive away users (unless it was ubiquitous - but early adopters would have to overcome this barrier).

Given the limited security benefit and significant usability impact, this scheme would probably not be widely adopted (which, of course, would increase the security benefits to anyone who did adopt it - there would be unlikely to be any malware designed to read the instructions; nor tools to reverse the modifications).

Answer 2

Furthermore not adding too much security as stated, the changes to the current password systems to allow your mechanism would make the password management weaker.

Current systems doesn't compare your answer with saved password but they compare encrypted answer with encrypted saved password (the system is unable to know your raw password). This encryption can't be done backwards. If you could do it you would have a really weak system.

So when you add characters or modify your password, the system has no idea about how to compare the encrypted modified password with the saved one.

Remember the system doesn't know your original password, and so should be in order to maintain the security of encryption algorithms.