3 ms·
Can We Replace Passwords with Placewords?
- onion2k 13y agoWhy not both? A password entry system that logs in to a full-privilege profile when the user is in a geofenced location, and that drops to a more limited user profile if the correct password is used outside of the set location. As far as the user is concerned they still just need to enter a password as usual, but the system is more robust due to the additional test. Further to that, the system could do things like immediately locking the user out if the wrong password is used outside of the geofence, and "Forgotten password" features could be disabled too. I'd be amazed if this sort of thing hasn't already been implemented in existing security software.
- krapp 13y agoTo me this still seems like a slightly abstracted password. The article does suggest a weakness in that malicious users could attempt to guess the coordinates that decrypt a message, but acting as if the physical location of the device actually enforces the security is wrong, I think. In the end, you've just got another encrypted string or hash sitting somewhere, on the phone right? ... although maybe if it's a strong hash it might not matter, but from what I understand (and I may be wrong), the hardware on modern smartphones can't handle strong hashes and tend to store secure data as plaintext or md5. Either way I don't see how this is necessarily more secure than a regular password, just a different way of generating entropy.