My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) previously given to him (not chosen at will). When authenticating, he is presented with 8 options such as:

1)  Vi - A - Ha - Re - K - Po        Me - Ni - C - Da - X - Xo  (5
2)  F - V - Ce - Xi - Go - Ka        Je - Va - Ko - Z - Qi - M  (6
3)  Sa - N - Bo - Pe - J - Wi        Mi - Vo - Hy - Ta - Q - G  (7
4)  Lo - Ti - Y - Xa - Ne - D        L - Mo - Ba - B - Zi - Le  (8

And he has to choose the group that contains the first sequence (in this case, the group 7 contains Hy). Then a new set of groups show up for him to find the second sequence, and another for the third sequence. The next time the user tries to authenticate, the process repeats, but with different groups each time. This usually happens at ATMs.

I'm intrigued by this technique, and want to learn more, but I don't even know where to start. Have anyone seen something like this before, does it have a name I could look up? Or if someone knows it well, could you comment on it?

I don't know how it works precisely, but my first impressions about it (which might be totally incorrect) are:

  • Each time the user chooses a group he proves knowledge of the password, without revealing it though - if someone peeks while he's authenticating, the attacker can only narrow it down to the symbols in the chosen group (the made up example above has 6 symbols in each group, but in practice there's more, I can't recall exactly how many).
  • To correctly learn the symbol an attacker would need to observe multiple authentication attempts. How many exactly, it would depend on how the groups are formed each time, whether or not they depend on previous attempts, etc.

(This is just a guess, I'm not even sure the purpose of this technique is what I think it is...)


You are correct!

This techniques is there to prevent your passwords from Shoulder Surfing. As you said, it allows a user to prove the knowledge of his password without, revealing it to the person who is shoulder surfing the user. There are many other proposed solutions to the problem of shoulder surfing, including some Graphical Password schemes. This survey on Graphical Passwords contains few schemes which can be used to prevent shoulder surfing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.