Thursday, September 8, 2011

Purely Pedantic Password Affirmation

PBKaC (Problem between keyboard and chair). Yes, people are the source of all problems in Computer Science, a computer does exactly what it is told to. But sometimes they can be the solution to problems too.

What if, when you entered a password, three things were sent back to the server?
  1. A password hash.
  2. A list of the times taken between keypress events for the password, hashed or something.
  3. Some identifying information for the computer, plugins, whatever.
The server could check the headers sent back to see if this is a common computer used by the user, and if so check the password and move on with its day.

The server could also check the times between keypresses in the password for relatively spaced times in the way the user normally enters the password, providing a fingerprint for a particular user.

Suppose it normally takes me 30ms to reach from "F" to "T", and fifteen to get from "O" to "."; if the password was entered differently the user should be redirected to a secondary question page; either they broke a hand, or someone else entered their password.

Think of it as non-random password screening. It would stop bots in their tracks, and would create only a small problem for users.

No comments:

Post a Comment