2

Instead using of the conventional password design (***** in a text entry field) in my mobile application, I've been thinking about letting the user create a 4 item password from a collection of 10 fruits instead.

You simply type username and match up your password (e.g. apple, pear, apple, apple) to login.

But I just thought as the password in our case would be visible on entry, it kind of defeats the point of such a mechanism. Is there any way I can implement this and solve this security risk?

  • 1
    The biggest security risk isn't 'over the shoulder' but that you've only ten fruit - with a four-fruit password, you've 10,000 possible permutations. Unless you also lock a user out after X attempts, it could be brute-forced very easily. – anotherdave Oct 12 '14 at 8:21
14

Sorry, but I find your idea a) not really user friendly [actually rather user un-friendly] and b) additionally I would also consider your approach risky – very risky – even if you managed to solve the visibility issue.

a) While I suppose it is true that our visual memory works quite good – I fear it would be quite difficult to actually have enough unique/distinct images of fruits. A user might remember some 'round orange fruit' in his password – but was it an orange? Or was it that apple? Additionally images might slightly different under different conditions / on different devices. Screensize, brightness, contrast – all factors that will make this scenarion user unfriendly.

b) Even if you came up with 10 brilliant images of fruits – it's just 10 – which makes your passwords as safe as passwords that would only consist of digits from 0 to 9. That is a security risk – a really bad one. This is why many registration systems ask the user to use a combination of at least 6 numbers and letters – and often encourage people to also use some CAPS. This way a user can choose from at least 60 different "fruits". A six digit password would then have at least 46.656.000.000 possible combinations. The more the better.

c) Last but not least I would have a suggestion for the usability / visability issue: you could give the fruits letters (or numbers) and ask the user to enter those letter in the password field. But this would make your password protection as secure as a system where you could only use the numbers from 0 to 9. Seriously: only thinking of it gives me the creeps. I think I would probably not register with a service that would use such a system.

d) And another reason not to use a four digit fruit-string for a password: I suppose you don't want to have to look and feel of a slot machine?!

  • Not to mention that it would be likely that most people would just pick "apple, apple, apple, apple" as their password because it's easier to remember. That's what people do when they can choose their own PIN: they choose either their (or someone else's) birthday or 0000. And you can't even choose your birthday with fruit. – JJJ Oct 12 '14 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.