Safe password storage and retrieval

Problem!

Passwords suck; if they're short, they're insecure; if they're long, they're hard to remember; if they're hard to remember one is inclined to write them down thus making them insecure; full circle.

One solution is to use password phrases but they have a poor user-experience; no-one enjoys entering long passwords on a mobile device, or anywhere else for that matter.

Solution?

I imagine a simple device with these properties:

• compact (credit-card sized; fits in wallet)
• independent (does not, cannot and need not connect to another computer to operate)
• does not depend on user memory
• biometrically authenticated (probably thumbprint)
• driven by one or more of: chemical energy (battery), kinetic energy, solar energy

Does such a device (product) exist?

No such security is typically needed but it would be kind of cool to have such a device.

Thanks for your invaluable feedback

fingerprint doesn't work on most girls. And it also doesn't work on worker types. And it doesn't work on injured hands.

I personally think password is good because it is independent on external forces such as health conditions and clone DNA and fake fingerprint and etc. password is not physical, thus, is independent of away from physical conditions.

2 minutes ago, magicalclick wrote

fingerprint doesn't work on most girls. And it also doesn't work on worker types. And it doesn't work on injured hands.

I personally think password is good because it is independent on external forces such as health conditions and clone DNA and fake fingerprint and etc. password is not physical, thus, is independent of away from physical conditions.

+1. Biometrics are convenient, but hardly secure. And the worst is, once your fingerprint is compromised, it stays compromised.

So what do you think would be the best solution for password retrieval?

If you were running Windows 8, you could use the new picture password feature.

If you're taking feature requests, I would want something like duress mode, where if you were being coerced into unlocking your account, it would look normal but hide information that you deem sensitive, while maintaining plausible deniability. Something like Rubberhose for windows.

-Josh

Duress Mode:

"Mr. Takagi did not see it that way... so he won't be joining us for the rest of his life."

@exoteric: You mean something like the RSA SecurID key fobs? 

http://www.emc.com/security/rsa-securid.htm

I like the card idea, but as pointed out above, fingerprints only work in the right circumstances.

Maybe voice recognition + RSA keyfob? I don't know if that tech is good enough yet.

Is a retina scan still something that is expensive? If you're retina has been compromised the bad guys have your eyeball...so you're probably not worrying about things much anymore.

@Harlequin: Facial recognition?  All you'd really need is a webcam and the software ...

Herbie

8 minutes ago, Dr Herbie wrote

@Harlequin: Facial recognition?  All you'd really need is a webcam and the software ...

 

Herbie

Or a color printer, cardboard stock, and scissors.

@cbae: Hmm, OK how about 3D facial recognition using a Kinect ...?

Herbie

Solution?

I imagine a simple device with these properties:

• compact (credit-card sized; fits in wallet)
• independent (does not, cannot and need not connect to another computer to operate)
• does not depend on user memory
• biometrically authenticated (probably thumbprint)
• driven by one or more of: chemical energy (battery), kinetic energy, solar energy

@Dr Herbie:

Wear a mask or get a cheap 3D Printer.

Same with retina, you just setup a kiosk for your service, collect your own retina data from your customers, and use that to 3d print what info you collected, and use it on services other than yours.

Password has no physical attributes and you can easily setup different passwords, you only have one DNA, one retina, one fingerprint, they are bound to be compromised anyou cannot change them. The lack of multiple passwords, lack of reset, ans lack of recovery just turn the system useless.

@Dr Herbie: is that even possible ??