I just want to note before you continue reading--this does not specifically apply to hashes or the key to encrypted messages. However, I am initially thinking about password/key solving/remembering by humans.

Today, the longer and more "complex" your passwords are, the more secure the password itself is, and the more secure the account/encrypted message behind it is.

We can easily program a scripts that generate a very secure password that is 100 characters long AND remember it AND run it in one second. However, human beings don't find it very convenient to type a 100 character long password, nor even remember it!

I was looking at the lines of the palm of my hand and thought, "could this be my password?", I also thought about people's signatures (the kind you write on a bank check) which then turned into another idea.

Sort of like slide puzzles (because it is a little similar, at least reminds me of it), people would put together a picture of a randomly generated set of "slashes" (not "/" <-- those kind, but if you were to take a knife and slash a piece of wood, like that--it has curves), or "curves", then it would be saved into 16 different sections (16--weird number, I don't know why I picked that), however, it would be saved in a completely random order.

The advantage of this is that it will use a more visual stimulant than a language stimulant (which language-based passwords can be hacked with dictionary hacks). That being said, I am thinking that users are more prone to remember more data from an image(-ish) than typing in characters.

The other thing is that is would be less prone to computers guessing the image. The thing that I'm thinking is that there'd be some fancy algorithms that would generate lines that would make the puzzle able to fit the wrong pieces together. That would patch up attacking it by finding the pieces that seem to fit each other.

Say, if every puzzle piece were both unique-looking to the user, however, every puzzle piece could fit together, it would be hard to attack, but easy to put together by a user??

If so, a puzzle like this would have 16^16 possibilities (fuzzy math right there).

The other thing I was thinking--first, I'll have to explain a little. Say someone's password is "jjj", and someone types in "jkj" and tries solving the hash with that. I'm thinking that (let's use the "qwerty" keyboard physical layout here) the computer could do just a little bit of brute forcing on the password. It'll try adjusting to characters that are near "jjj", say a 3 character radius of that password to give the user a little bit of grace when they don't get their password exact, but close. Maybe, you can think of it in another example, where the hash is case-sensitive and the password inputted is incorrectly cased. The computer will try every case of the inputted password, until it reaches a certain number of tries (because then it would be cracking the password, not giving the user grace) or it finally does a little bit of "breaking" (to give the user grace).

That being said, if there is a "Slash Password" (that's what I'll call it) where the user isn't given a puzzle, they have to slash (say, a touch-screen tablet) it purely from memory, without hints, it could give a little bit of grace (because slashes may not be exactly matching the hashed password). It would try and adjust the lines about 5 points in every direction (kind of like the "±" concept in math), which would require a little bit of processing power, but it would take a crap load of processing power to a real attacker because they would have to try and adjust the lines so much, much, much more than it would be if a user was close to the real password.

This would also be extremely obvious to algorithms (like ReCAPTCHA) that try to detect bots from real users. It might even become safe for Google to hand their users their hashes, then it would be so difficult to break them, and the "grace passwording" would be processed on their end. Then, only the correct answers would be handed back to Google.

Just a few ideas, and I'm posting this idea publicly because of this, so posting this publicly would prevent this idea from being patented. Also it's a cool discussion/answers.

I guess my question is, is this probable? Like, possible, realistic? Anyone try this yet? (is this the correct stackexchange? I feel like it contains topics that a little bit of every stack exchange would/should have on it.)


Your question is a little hard to follow, but I think I get what you're getting at.

A simpler way to think about this would be as a tangram based password.

A quick Google search for number of possible tangram combinations reports that there are more than a billion possible combinations from a single tangram set.

By itself that isn't sufficient, but if you chain a few together, (e.g. a password might consist of 2 to 4 specific random tangram solutions the user has to remember in order.)

The other issue here is that these tangrams would need to be able to map to a binary key, and be generated from binary keys including their positions relative to one another and orientation, or have a pre-generated list of tangrams that can be mapped to incrementing binary values.

For example we as a community could select 16,777,216 or (2^24) different tangrams, and map each one to a different 3 byte code, we could then have a program generate a random 48 or 72 bit key, and it would map to 2 or 3 tangrams users would have to memorize.

While this is possible, and might even be fairly secure as at its heart it would just be a way for users to remember a longer more secure key, this wouldn't make it safe for hashes to be released, nor would it allow differentiation between users and computers like a captcha.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.