2

An obvious problem with passwords is that if an observer sees a user enter it, then the user has lost the password secrecy. Some systems try to defend against this with dark screens or with shields around button inputs.

I was wondering if there are any implementations or research into "complete knowledge" password systems. In other words, an observer can observe and record all the things observable to the user, such as screen and keyboard and sounds, and still not be able to enter a valid password.

For example, the screen could display X, and the user could mentally compute Y = f(X), and input Y. F is a function known only to the user; it could be a number of things like word games or graphical transforms or mathematical or a combination of all of them.

A few problems I see with this: if f is too complex, the user won't be remember or compute it. If it is too simple, the observer will be able to guess it. Also, it seems like a lot more work than physically obscuring the view.

Still I wonder if anyone does research into this subject, and if there is any terminology for it. Thanks~

PS I apologize if this question has been asked before, I'm not sure what the common terms are for this subject to search for.

EDIT: I have migrated this question to the security stack exchange, thank you for the suggestion.

1

The only approach that is valid if you must assume that you will be observed is the use of One-Time Passwords. These are designed for such situations. Put another way, you need a factor of authentication that expires as soon as it is used.

As a side-note, this question would be more suitable for the Security StackExchange site.

  • I will migrate the question then, thanks for the suggestion. – DanielV Jan 17 '16 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.