Emerging Tech

Sanity check: Can the Vidoop visual grid replace password authentication?

Vidoop's dynamic visual grid is the latest attempt to solve the long-standing password problem. See how Vidoop works, why Vidoop might succeed where smart cards and USB tokens have failed, and the questions that Vidoop still needs to answer.

Issue: Vidoop visual grid as a password replacement

As I wrote earlier this spring from the Web 2.0 Expo, one of the most innovative new things that I've seen in the IT industry in 2007 is Vidoop's implementation of visual image recognition as an authentication system to replace passwords.

There are essentially two solutions that Vidoop offers:

  • Vidoop Secure -- This is the software that makes the whole thing work. It runs on a backend server and can be licensed by businesses to replace their existing password authentication system(s) across the enterprise. The software was designed to integrate with LDAP and Active Directory. It has been adopted by more than 40 local and regional financial institutions.
  • MyVidoop.com -- Still in Beta at the time that I'm writing this, MyVidoop.com is Vidoop's public implementation of its visual grid. It runs Vidoop Secure on the backend, and on the front end it can be implemented with any site that uses OpenID. The goal is to provide stronger Web authentication and help users so that they do not have to juggle so many Web passwords.

I've tested the Vidoop system through an invitation to the MyVidoop beta and here's how it works:

1. You create a user ID that becomes a URL (userid.myvidoop.com).

2. You choose three image categories (e.g., houses, computers, people).

3. You have to activate the computer you are using as a legitimate user of your ID. This is done via a confirmation code to your e-mail or a text message to your cell phone.

4. Once you receive the confirmation code, you enter it into the MyVidoop screen when you log in and then you no longer have to activate that computer the next time you log in from that computer. However, you will have to activate each time you log in from a new computer to confirm that you are you and not someone trying to crack your password.

5. Once you enter your user ID (and have activated it on your computer), you receive your Vidoop visual grid. You locate the three images that represent your categories and enter the corresponding letters into the Access Code field.

The grid is dynamic, so the images and the letters change positions each time the grid appears.

Here are two videos that further explain the Vidoop solution. The first is a five-minute Vidoop overview from the Web 2.0 Expo, and the second is a Vidoop-produced video that delves into the Vidoop Secure technology.

Sanity check

IT pros have long known that passwords are one of the weakest links in enterprise security, and multiple vendors have developed solutions to try to overcome the password issue. For example, smartcards and USB keys have been proposed as two-factor authentication mechanisms. However, neither of them has ever been widely adopted because they are expensive and difficult to deploy.

Vidoop has a number of advantages that could allow its visual grid to succeed where smartcards and USB keys have failed in enhancing authentication on a large scale:

  • It's less expensive and easier to deploy because it does not involve physical hardware.
  • The visual grid is simpler and more intuitive for the average user to understand.
  • It scales better because it is software based.
  • Vidoop is currently developing modules for VPN and Outlook Web Access, which are two of the biggest security soft spots in the enterprise.

Of course, Vidoop also has some drawbacks and some questions that it will need to answer:

  • How well will it translate to mobile? The world is becoming much less tied to computers and much more involved in computing with mobile phones. Vidoop will need its solution to translate seamlessly to mobile.
  • The performance and reliability of image loading needs to improve. With MyVidoop.com, there are times when images load slowly. If users have to wait for images to load before they can log in, this solution will never fly. The images have to load instantaneously and can never fail to load on any platform.
  • Is it wise to hitch the Vidoop wagon (at least on the Web) to OpenID? The jury is still out on whether OpenID will be universally or even widely adopted. The Vidoop solution is good enough to transcend OpenID.
  • Similar solutions such as PassFace are already offering a competing approach to visual grid authentication. What if Microsoft or IBM jump in?

What do you think of the Vidoop solution and the potential of a visual grid replacing passwords for authentication? Join the discussion.

I have four Beta invitations for MyVidoop.com and I will send them to the first four TechRepublic users who send me a message.

About

Jason Hiner is the Global Editor in Chief of TechRepublic and Global Long Form Editor of ZDNet. He is an award-winning journalist who writes about the people, products, and ideas that are revolutionizing the ways we live and work in the 21st century.

58 comments
lee.ajaye
lee.ajaye

Definitely a huge step in the right direction! Might not be the end all, be all for all players, but looks like something great and easy to use. I'm very interested in seeing where this might lead.

jacky.cheung
jacky.cheung

Can it really prevent Man-in-the-middle attack? The intruder can still sit in the middle waiting for the authentication process to start, block the genuine image grid and present to the end user a fake image grid to capture what the user's categories are. Is that possible?

cswearingen
cswearingen

Admittedly I've only skimmed this story. But Ummmm.... what about the blind or visually impaired users?

martinomg
martinomg

It can work as described, sure. It's really no different than a password in principle, so there's nothing to prevent it from working. I'd suggest that the image-loading issue could be addressed by placing a fair number of "stock" images somewhere on the client machine representing the categories. The stock images could be overwritten following a successful authentication, so that way all the "loading" would take place only after a successful entry of the password. It occurs to me that placing stock images on the local client makes them available to be examined while "offline," which might decrease the security. So it might be worthwhile to use pictures which depict multiple categories, so that clicking on any given picture won't represent "a category" in itself, but rather a few different possibilities. Blending the categories would also help prevent people from determining your categories by watching over your shoulder. In theory, blended categories could be a bad idea, in that it might become possible for someone to guess your three categories by simply generating enough assortments of tiles--if you only ever see a single picture of a cat in each set of tiles after 1000 authentication requests, you might reasonably guess that the cat is a category. But hopefully the categories would be broadly enough defined that the user doesn't select "cat" as a category, but rather "animal," or "fur." If a picture of a Valentine's heart-box of chocolates could represent the categories "sweet," "red," and "gift," and a given user has selected the "gift" category, the user would know why he was selecting that image, but a spectator would not. Of course, the more general and vague the categories become, the tougher it might be for the user to identify his images... A minor benefit about the image verification is that it's language-proof. Yep, I think it's a fine idea that would work based on the description of the article, but I'd want to see a far more detailed description of the options and think a bit about the details to see if it could be improved, also. A question: would replacing all the images after each image is selected have any effect on the overall security of the system? Why or why not? I'm wondering (I haven't really gamed it out yet) if it would be better to have each picture a member of multiple categories AND replace all the images with each selection. So if my categories were bird / sign / transportation, I'd see a set of pics, one of which was a beach shot (with seagulls) and select it as my "bird" entry. The rest of the pics get replaced. Then I select the picture of the path to the Grand Canyon (with a sign pointing the way), and all the pics get replaced. Then I see a picture of a train bridge with a train on it. That seems to me to be a stronger approach than using simple "single-category" pics. Sound right to anyone else? Am I missing anything obvious there?

david.dowdle
david.dowdle

it's slightly more secure than I first thought, removed

chaz15
chaz15

Re: Passwords I don't like passwords as to have any value at all they have to have many characters. And often changing passwords can be a nightmare. Logged out of system, have to email/ personally contact/ phone someone etc. The idea with Vidoop is good as far as it goes. Maybe having 4 choices out of 20 pictures would be more secure. The images can be low quality/ low resolution so load is not an issue. How long does it take to get an activation code? Once activated, after say 3 failed attempts, the user should be locked out until a new activation code is obtained, BUT, it really does depend on how secure the Vidoop software sytem is, and just as importantly how secure (or not ...) the network is. But as this goes for ANY security sytem, the Vidoop system seems a good idea in removing the remembering password issue!!!! Security ultimately though is only as secure as the software, unless eg hardware donggled!!!!

ken.leitman
ken.leitman

This has been done before and failed each time. just another take on an old system. I can see this will geenerate a lot of calls, some people can't see all that well to start with, and in different countries, the pictures may be completely alient as to what the subject matter is.

techrepublic
techrepublic

In order to judge a system one must first consider what it is trying to solve. Password systems suffer from a number of problems, for example: 1) users complain that they are difficult to remember; 2) they are often vulnerable to 'shoulder surfing'; 3) they are often vulnerable to 'social engineering'. Psychologists suggest that people find it easier to remember pictures than arbitrary sequences of characters. Non-arbitrary sequences are unsuitable as passwords for different reasons. This suggests that picture-based systems may help to address point 1. Randomising the position of pictures and using only a subset of the available pictures each time helps address point 2. Point 3 is where Vidoop may be weaker than some alternatives. The PassFace system, which you also mention, uses faces for two distinct reasons: a) they are easy to remember; b) they are difficult to describe. It is this second attribute that is a key strength of PassFace - no matter how plausible the person asking for your password, it is very difficult for you to describe it to them. In other words PassFace helps protect you against gullible employees. Vidoop appears to address points 1 and 2 but, unfortunately, a gullible employee can tell somebody over the phone their list of categories. Jason's criticisms of the system seem to be mainly concerned with particular environments. That is not to say that they are unfair, but that you need to have such an environment for them to apply. Somebody sitting at a workstation with adequate network throughput may well see an improvement in security, although PassFace may be even better.

jclaff
jclaff

My Credit Union is using a similar system as a second level password. You have to choose three pictures (out of 9) in the same order as you registered them and their position changes each time you go to log on. There are a couple of rules governing how many goes you get at getting them right. It works well as long as you remember the order you chose originally. Jack Claff

dford
dford

I haven't watched the videos - but why is three non-repetitive single case letters (i.e. 3 out of 26) more difficult to crack than the (relatively) random eight or ten letters and symbols in a good password? It wouldn't take that long to crack it manually. The only advantage I can see is that you get a new password every time. I hope there's more to it than this but it looks very much like a sledge hammer to 'crack' a nut. I can imagine it will be very successful as it is essentially a method of out-sourcing (shirking responsibility for) security. David

doughalve
doughalve

Vidoop will be launching the consumer version of myVidoop later this summer, which will have some new features. This means no more invitation codes required. You can request an invitation code on the myVidoop.com web site also. Vidoop is also addressing the mobile platforms and giving users a variety of ways to enhance their indiviudual security online.

BALTHOR
BALTHOR

Use an ID card scanner.

frankmcbride
frankmcbride

Unique; yes it is. All that different from the point of entry into the host? Not from what I can see.

stone.cherub
stone.cherub

This looks like a great idea and I am eager for some way to get rid of my spreadsheet of passwords. But I'm a user, I don't get to decide on the kind of password system the websites I visit offers me. I take what I get, generate a password and then write it down because I'm HUMAN, I forget things. I use a pattern for passwords and I even forget THAT! I would Love to see this on my bank's website but that isn't my choice, it's theirs. And that's the problem.

doughalve
doughalve

Vidoop has the option to be configured down to the individual user. On a system requiring ADA compliance, Vidoop would simply require an out of band code to be generated for each time that individual is authenticated. The GRID is not used in the authentication process, for visually impaired users. There might be several authentication options (configurations) based on groups defined by the administrator. Essentially, the Vidoop system functions as a key fob (hard token) solution, using any phone associated with the user profile or via SMS text message or email, the later being less secure, but an option available to administrators. As a post script to the forgotten image categories over forgotten passwords, wouldn't it be nice to eliminate calls to IT to reset passwords? Vidoop can automate the select new categories process (forgot my categories) allowing the user to receive a one time out of band code in order to select new categories. This means users can help themselves and fewer calls to IT support.

pdeetlefts
pdeetlefts

How would blind people benefit from this?

gregweigold
gregweigold

For most people, remembering a series of phtots is far easier than remembering a series of characters that make no sense... which is why so many people have to use some kind of mnemonic for their password, hence the post-it notes! My father, with his Alzheimer's, would still do far better with the pics than letters...

1dennis3
1dennis3

If users have a hard time remembering their passwords, how in the world will they remember what pictures they chose and espically in what order. I deal with users daily that cant remember their passwords and have to be reset, some more than once in the same day. People in the working world that only use their PCs for their job and only do one thing on them will have a very hard time with this. I still think finger print Id is the way to go.

mmartino
mmartino

Somebody help me out here. If there are nine images on the screen and I must choose three of them (the 3 that satisfy my categories) it seems to me that the actual number of possible choices is 9*8*7 or about 500, not 17,000. If the grid were expanded to say 8 x 8, then the value would be much larger, but it seems difficult to do this since there aren't 64 letters in the English alphabet. Perhaps the grid would be limited to 6 x 6and might use the ten digits in addition to the alphabet. Still, the number of keys using just three images is still only 36*35*34 or or about 43,000. When these numbers are compared to a six position password using upper and lower case letters and digits, they don't really seem to be very large. For passwords meeting the criteria here, the number of possibilities is equal to about 8*10**17. Increasing the number of items (and hence, categories) the user must select from can improve the size of the key space. Choosing four items from a set of 36 has a key space size of about 1.5*10**6, but this is still quite a few orders of magnitude less than the standard password. If anyone finds fault with my math, please let me know. mmartino@austincc.edu Michael

kevin.stafferton
kevin.stafferton

I haven't watched the video either but I suspect the answer is in your post, because you get a new password every time. Every time includes every time you get a password wrong, a new one is generated. A static password can be broken by brute force, this method means you only have a 1 in 17576 chance every attempt.

lalit_mishra86
lalit_mishra86

guessing three numbers put in is a lot easier than guessing password when looking over the shoulder

Dr Dij
Dr Dij

is made up of something you know (passwords or vidoop, security questions, etc) and better if add something you have (ID cards) - shouldn't be used alone as they can be stolen or forged and even better with: something you ARE (biometrics). harder to forge (except that popular versions such as laptop fingerprint scanners seem to be very prone to false positives so should not be used alone.

doughalve
doughalve

Well, the time has come, we are ready to Open myVidoop up to the rest of the World. Visit myVidoop.com tomorrow Sept. 18th and stake claim on your myVidoop domain. This will truly be the last account you ever need to open. I have been using the new features for a few weeks now and I know everyone else will really enjoy using the site. The feedback we have received since April has allowed us to polish the site and features to a nice shiny service. Have fun!

akaim
akaim

So,... for each new computer (or rotating IP address) you have to re-authenticate and possibly/conceivably(?) pick new categories? So people will screw up by having multiple categories on different machines? That could never happen... right? Are Rock, Paper, Scissors in the categories?

heyjoe
heyjoe

Maybe I'm missing something, but if I'm clever, don't I just have to refresh the page a few times, taking notes on the pictures that are displayed, to figure out what groups repeat on each page? For example, if I notice that every time I refresh, there's a picture of a cat, an airplane, and a house, can't I infer that perhaps those are the targets I'm looking for? The article shows a 12-image grid. If I have to select 3 images, that means that if there are more than 4 categories, there will be incorrect images displayed each time that come from different groups, but possibly only 3 each time from repeated groups. Is there some mechanism that prevents this?

Murphy Chan
Murphy Chan

any OTP gadget/software is sure a direct competitor of vidoop, but it did a pretty nice job on the interface. Not so sure how the security works on vidoops. Token based OTP with smart card, will take the security features to at least 3 factor of authentication, not sure how vidoop is going to reacts to this kind of technology. Overall, vidoop got the upper hand in terms of visual. With the self service category reset, IT admin will have a lot of free time.

casaderoger
casaderoger

Banks and credit card companies think they have a solution to security in placing a cookie in your machine to identify it for future log ins. I clear my cookies regularly and constantly find myself getting " You are logging in from a new computer" messages, simply because the cookie is gone. Then you have to get an authentication code by email or text message and go through an entire dance, just because you didn't leave their cookie in your machine. It's more trouble than the little added security is worth.

sureshkaukuntly
sureshkaukuntly

Vidoop is really out of the box solution for web safety. But Vidoop do suffer from problems like spyware and man in the middle attack. The software token which is placed on the registered system is just a .sol file placed at similar location as "Documents and Settings\user\Application Data\Macromedia\Flash Player\#SharedObjects\2NVKS4RH\myvidoop.com\swf\vidsec_token.swf" Just copying the file using some spyware and sending it across to the bad guy will give the bad guy access to the grid. Do read http://ha.ckers.org/blog/20070418/vidoop/

Sagax-
Sagax-

History has demonstrated that any security system that one person can build, another person can defeat - if it is worth the trouble. If you accept this premise, then you must eventually migrate to a tiered system. Thus, the more sensitive (critical, dangerous, or whatever) the data, the more stringent the authentication system. I suspect that at high security levels, multiple authentication systems may be employed. Vidoops may one of the elements. BTW is that pronounced vid oops?

tr-gtn
tr-gtn

...I'll have screen prints of the images users have chosen hanging on their walls.

ittrae
ittrae

I like the idea of visual grid authentication a lot better than passwords because of the user friendly aspect and the fact that most people have way to many passwords to remember already without adding one more to the bunch. But I had not thought about the loading of pictures being a problem. Even with that possible flaw, it seems as though that problem could easily be fixed if it were happening. So I guess that I like Vidoop's implementation of the visual grid because of it's innovation and thought behind the idea itself.

xabyte
xabyte

A static password can be brute forced, good luck in doing so with a "just a few machines." One needs to look at the question and answer here. Any application is only as secure as what? =]

alaniane
alaniane

Many of the users that currently use post-it notes to remember their passwords will also use post-it notes to remember the sequence of pictures. So, instead of dmZ17 there will be car, computer, house. Also, there will still be the problem of social engineering. If Bob is into fast cars then more than likely one of three picture categories will be autos. It is an innovative way of securing a system and it could prove to be an effective additional layer used in securing a system. However, as mentioned before it can be cracked if someone is determined enough to do it.

jasonhiner
jasonhiner

The user can enter their the letters in any order as long as they have the right categories. However, an admin can change the settings to make order matter, if he/she chooses.

dave
dave

Michael, You have hit on one of the limitations of this scheme, at least in the limited form we see it here. 1. Lets think about how many categories there are. 40 would be reasonable to choose from, but there might be as many as 100 and still have a reasonable human manageable set of images. Then for a three category ID, assuming that the order of the categories is significant, there are only 100*99*98 possible individual choices. We can approximate that as 1 million or 1x10^6. That is right at the threshold for a "secure" password, not in terms of a brute force attack, but just in terms of getting lucky. For highly sensitive security items (for which Vidoop is not really intended, I assume) this is not quite acceptable. If you go to 4 categories, you have created a serious challenge for your user when identifying, especially with low resolution images. 2. Now lets look at what is displayed. The examples all showed a 3x4 grid for 12 choices. If you see the screen, then a random guess of three images (not three categories) will get the right password one time out of 12*11*10 = 1320. I would not want to risk access to my bank account to those odds. The larger the grid gets, the more difficult the recognition and selection problem becomes and the more the display and bandwidth become limiting factors. 3. The third brute force odds come from just guessing three characters, without seeing the images or detecting what characters are shown in the 12 (for example) images. Since the characters are neatly set off by a red circle and use a standard (or at least constant) typeface, this is probably an upper limit case, tending toward case 2 if you allow use of OCR software by the phishing site. Anyway, we now have, assuming only numbers and upper case letters, 36*35*34 choices. Roughly 4x10^4 or 40,000 possibilities. That is pretty good, although, again, it is not good enough for high sensitivity access. Finally, we can look at the bottom line for a phisher: If a man in the middle can generate ANY image grid, and analyze the real image grid, the odds become those in case 2, namely 1 in 1320 for the parameters assumed. Given that the access that the phisher gets is ONLY that one time, and assuming a low but workable number of people who fall into the phish bowl in the first place, a return rate of one out of 1000 of those might still be well worthwhile for something like a wire transfer of enough money. So the elegance of the Vidoop system needs to be evaluated for any particular security application to see if it fits.

jrensink78
jrensink78

Vidoop will put a software token on your computer that the authentication server requires to even show the login image grid. So trying to do a brute force hack becomes very hard. Without the token, you can't even attempt to log in with the user name. But if you somehow did, the odds would be 1 out of 42840 to guess a password in one try (36*35*34), since both characters and numbers can be used and they have to each be unique. This is assuming they don't use both letter cases. The best odds are actually trying to hack someone's password from their computer. In the video, the example showed only a 2 character password example. This would give the odds of 1 in 132 (12*11). If you get 3 tries before lockout, it changes to 1 in 44 (132/3). Regardless, this is still a much better method than the usual password/login. It protects against many forms of hacking from the outside attacker. Plus, it would (hopefully) get rid of the post-it notes under the keyboards with the passwords to better guard against the internal hacker.

ESchlangen
ESchlangen

Why couldn't someone intercept the packets (I know this is done already) over time and detect the binary signatures of the pictures to see which ones keep showing up? Wouldn't this reveal the correct sequence of letters? (BTW, I didn't watch the videos either and if the pictures also change, please ignore this post).

heyjoe
heyjoe

Actually, let me correct a mistake of mine I noticed. With 12 images, there can be 12 categories before you can start eliminating categories using the refresh method. It seems that the more categories there are to choose from, the less secure this system is, because the odds of non-repeating categories will increase. And if there are only 12 categories, each category will repeat so refreshing won't give you any extra information, but then all you need to do is brute force the possible combinations of 3.

lonewolftech
lonewolftech

I use the same bank. I have cards managed by other banks that do not use that cookie crap. I use Password Corral with secure passwords and that is all I need. I still don't trust visual recognizability that much.

koes
koes

Hello, To address this concern, the authentication token that is dropped when you check 'This is my computer' box is actually tied to your IP address, OS, and browser. Thanks! -Koesmanto Bong

Tenagra71
Tenagra71

I found a post it with passwords and the logins they supported, along with the client ID taped on his display. I took it and trashed it and let him know so and that it was a violation of security policy. He had a cow, got really pissed off. I felt like yanking his logon perms. Jerk-off....

smitty2.0
smitty2.0

My Sentiments exactly....U go Vidoop!

DBENSKIN
DBENSKIN

If simple descriptions like mountain, river and plane are used then it would be hackable, but if more complex descriptions like: "Snow falling on Mount Fuji in Japan" "The Nile in Egypt 1988" (dated description of pic) "British Airways Concord on last trans Atlantic run" These clues require the cognitive response of the user to determine what the category is. If you are careful not to put key words like Mountain, River, Plane, Car or Flower into the descriptions then it would make it difficult for bots to guess what the category is. "CAPTCHA" is a picture of text, which can only be described by repeating the same letters in the photo you are trying to hide, but by describing a photo of "The Sidney Opera House Fireworks celebration 2006", the hackers would have to write code that is capable of visualizing images from description to effective guess that the category being described here is not Buildings nor Fireworks, its "Night scenes". Think about it, what time does the fireworks at the Sidney Opera house displayed on new years?

keithc
keithc

But that then defeats the purpose of security. If there is basic alt-text on the images, it would be very easy to hack. It's the same argument with CAPTCHA's ... they only work for sighted individuals, and an alt-tag just makes them extremely hackable.

DBENSKIN
DBENSKIN

Resolving the issue of blind users accessing the Vidoop system is simple. Vidoop would only need to provide a description tag on the photo. A screen reader program (that the blind user already should already have on their machine) would just call the name of the picture (or describe it briefly) and the letter associated with it. This is the same technique used by web designers who build sites for the visually impaired.

keithc
keithc

I am an IT guy for a disability rights non-profit. We have staff who are blind and use assistive technology devices to use computer, such as screen readers. There is no way they could use the system described in the article.

pdeetlefts
pdeetlefts

I have a friend who is a C, C++ programmer, and he is blind. And I might add. He is excellent at what he does. But he uses brail devices and voice applications to "see" what is on the screen. Thanks chippsetter for your reply.

chippsetter
chippsetter

Are you implying that blind people don't use computers? There are computer setups for the blind.

jasonhiner
jasonhiner

The categories stay the same but the individual photos change each time.

george
george

Allowing an email-based account recovery on sites like blogs, forums, etc, is effectively a usability REQUIREMENT. As an OpenID provider, myVidoop provides authentication for things like that. myVidoop is not what you would use to sign onto your online banking system. Koes pointed out that banks can basically flip a switch to disable the reliance on e-mail (which you object to), which is a point that apparently needs to be re-emphasized.

heyjoe
heyjoe

Sorry, but you can't reset my current online bank account's password just by compromising my email account. You would also have to get through a number of other security checks in order to verify that you were me before you could even get to the password reset screen. Claiming that other existing systems are as insecure as yours doesn't make yours secure. As I said, I think the idea is interesting and I look forward to seeing what it can eventually do. Until then, best of luck.

koes
koes

We already have that exact general problem with email with the current common system, except to a much greater degree -- currently, if your email account is compromised, all that the attacker has to do is click on the "I forgot my password!" link, and he has the ability to reset your password. So Vidoop already beats out the security that you have on your typical blog, forum, portal, etc. type of website, since having your email address compromised is not enough to have your account totally compromised (or, at least, not immediately, hopefully buying you some time to notice. It also becomes a MUCH more expensive prospect from the standpoint of the attacker.) So the most legitimate concern is related to how a bank (or whatever) would implement it. It's worth noting that the configuration at myVidoop.com right now should be considered a "low security" implementation of the Vidoop technology. The underlying system, Vidoop Secure, has the ability to make grids of much larger sizes, with larger numbers of categories or ranges of categories (i.e., the attacker won't know exactly how many categories you have), and with a configurable number of failures to device deactivation (as in, a new out-of-band activation code is needed to see the grid again). Also, the current random-order can be turned off in favor if sequential -- that is, you have to enter your categories in the same order you chose them. It's also possible (not for a myVidoop user currently, but in implementing a custom licensed Vidoop Secure installation like a bank licensee would) to control the methods of out-of-band transmission, meaning the method of email could be disabled to avoid any reliance on the security of email. It's worth remembering that myVidoop right now is still in beta, and while it's a decent demonstration of the technology, it's not the ONLY way to implement it. In fact, next month, a lot of new features are going to roll out to give users considerably more control over the security of their account. I guess my biggest problem with your argument, and similar ones, is that when we discuss our current baseline of security in this context -- passwords -- no one ever says anything like "But they don't have security, because if your email gets compromised, you can lose all your accounts!" After all, even without an email-based account recovery feature, I'd be willing to bet that the odds are better than 1 in 1320 (to pull a number out of thin air) that the password on that email account is the same as the password for something important.

heyjoe
heyjoe

Interesting. I'm not trying to knock the system, because I think it's interesting and I appreciate what it's trying to accomplish, but a major part of its security -- the PC authentication -- now relies on the security of an outside email account, and the odds of guessing the passcode combination on any given attempt are 1 in 1320, as there are only 12 characters at a time to choose from (12*11*10). Locking the account out after a certain number of failed attempts will help a little, but not much if the email account is also compromised. This system is using a novel way to work with passwords that are fundamentally weak, relying on other add-on measures (PC authentication, account locking) to bolster security to an acceptable level. I don't think I'd want to rely on it yet to protect my banking, but I'm interested to see where it goes.

koes
koes

before you get to see the image grid, you'll have to authenticate a computer if it's not yet activated. an activation code is sent to you either to the email address or phone number (voice or text) associated to the account. when you enroll, you are given a bundled image categories, meaning you'll always see your 3 secret categories and 9 other categories . you'll always see 12 same categories when you refresh the grid. the letter associated to each image also changes everytime, and a lockout is initiated after several failed login attempts.

sureshkaukuntly
sureshkaukuntly

Thanks Koesmanto, but is this functionality new????? i had tried a few months back when vidoop was introduced. I was successfully able to see the image grid on my office computer without registering the system. what i did was place the token i.e .sol file exactly at the same place where i found it on my home computer. well, will check out it again. But doesn't the IP address change often if i use a dialup connection???? Thanks and Regards, Suresh