Re:The Usability of Passwords
by TweedHeads on Saturday May 16, 2009 @01:55PM
(#612365)
Here is an idea:
- 256 random chars long passwords stored in a bluetooth keyring.
How it works:
pre-session:
- every user registers two passwords, short and long.
session:
- app asks for password
- user does nothing, computer recognizes keyring
- computer sends 256pw to app
- app accepts two kinds of pw, short and long
- if pw.length > 200 treat as keyring pass
post-session:
- if user loses keyring, he can deacativate his 256pw
- user can change 256pw at will, just buy new keyring, update password on app.
That's how I see it, and that's how I would like to do it.
Keyrings can be anything, just a chip and bluetooth, can be carried or placed on a desk, can have buttons to press to send the signals, can be locked, can have many shapes and colors, etc.
The secret is not the keyring, I know there are plenty out there, the secret is in allowing apps to accept two kinds of password: short, user generated, or long, device generated, so convenience is on the user's side.
And when machines fail, there is always old-password at hand.
- 256 random chars long passwords stored in a bluetooth keyring.
How it works:
pre-session:
- every user registers two passwords, short and long.
session:
- app asks for password
- user does nothing, computer recognizes keyring
- computer sends 256pw to app
- app accepts two kinds of pw, short and long
- if pw.length > 200 treat as keyring pass
post-session:
- if user loses keyring, he can deacativate his 256pw
- user can change 256pw at will, just buy new keyring, update password on app.
That's how I see it, and that's how I would like to do it.
Keyrings can be anything, just a chip and bluetooth, can be carried or placed on a desk, can have buttons to press to send the signals, can be locked, can have many shapes and colors, etc.
The secret is not the keyring, I know there are plenty out there, the secret is in allowing apps to accept two kinds of password: short, user generated, or long, device generated, so convenience is on the user's side.
And when machines fail, there is always old-password at hand.