I'm sure I will be quickly corrected if this is a stupid idea, or if it has already been tried. My question is: has this idea been tried before? If not, are there good reasons it would not work, or would not improve security?
It is easier for me to remember my current password algorithm by entering it in four different pieces. In order to enter those pieces correctly, I have to move the cursor around, so for example, first I might enter (this isn't it, just similar):
Then I might do:
It just occurred to me: why couldn't you, as a part of the password confirmation, use not just the text of the password itself, but also the ORDER it was entered..?
I don't see any reason this would not be technically possible. It's true that getting people to take advantage of it would require a change in user mentality, and there might be a very large learning curve. However, at the same time, I assume that 99% of people who enter their password do it the same exact way every time, and so for those- the vast majority- they would not be effected by the change unless they wanted to be.
I also assume most folks directly enter their PW in sequential order every time (unless they make a mistake and go back to correct it), so they'd be unlikely to notice it. Only people who want to take advantage of the additional security would be impacted.
Including the order of when each character was entered would add a large amount of additional randomness to the password (and the magnitude of randomness would increase with every additional character added - e.g., for an 8 character password, if my math is right it would add 8! more possible iterations, 10! for a 10 character pw, etc etc).
An additional benefit, and I think this is probably the biggest potential for this idea, would be that you could store the password (encrypted) string itself separately from the (also encrypted) order on a server. In this way, if an attacker wanted to steal passwords and use them, the attacker would have to have BOTH sets of data in order to make use of them! A 20 character password - obtained from, say, a carelessly stored piece of paper - would still have >10^18 possible iterations.
So you (ie, someone smarter than me) could figure out a way to store - completely separately - these two interleaved forms of identity confirmation so that each is equally difficult to steal, but they are both checked at the time the pw is entered.
It would be really easy to store the password order, too. Just do it as a list integers. So for my example password above, the 20 character order might be stored like this:
6 7 8 9 10 1 18 19 20 2 3 4 5 11 12 13 14 15 16 17
Perhaps the idea could also be extended to things like private keys, though I don't know enough about the subject to say so definitively.
Perhaps the requirement of moving the cursor around is too arduous. What about rich-text passwords? Why not allow italics, bold, underline, etc etc, as part of password entry? How about color? As with the previous idea, nobody would HAVE to be affected. Only those who choose to be affected would be impacted, and similar to the previous idea, you could store the style information separately on a server for the enhanced protection from theft of a password database.