Geographical passwords easier to remember

It's much easier to remember a place you have visited than a long, complicated password, which is why computer scientist Ziyad Al-Salloum of ZSS-Research in Ras Al Khaimah, UAE, is developing a system he calls geographical passwords.

Writing in a freely available "open access" research paper in the International Journal of Security and Networks, Al-Salloum emphasizes how increasingly complicated our online lives are becoming with more and more accounts requiring more and more passwords. Moreover, he adds that even strong, but conventional passwords are a security risk in the face of increasingly sophisticated "hacker" tools that can break into servers and apply brute force to reveal passwords. Indeed, over the last few years numerous major corporations and organizations -- LinkedIn, Sony, the US government, Evernote, Twitter, Yahoo and many others -- have had their systems compromised to different degrees and overall millions of usernames and associated passwords have been harvested and even leaked online.

Al-Salloum has devised geographical passwords as a simple yet practical approach to access credentials that could provide secure access to different entities and at the same time mitigate many of the vulnerabilities associated with current password-based schemes. The new "geo" approach exploits our remarkable ability to recall with relative ease a favorite or visited place and to use that place's specific location as the access credentials. The prototype system developed at ZSS -- Research has proven itself capable of protecting a system against known password threats. "Proposing an effective replacement of conventional passwords could reduce 76% of data breaches, based on an analysis of more than 47,000 reported security incidents," Al-Salloum reports.

The geographical password system utilizes the geographical information derived from a specific memorable location around which the user has logged a drawn boundary- longitude, latitude, altitude, area of the boundary, its perimeter, sides, angles, radius and other features form the geographical password. For instance, the user might draw a six-side polygon around a geographical feature such as the Eiffel Tower, Uluru (also known as Ayer's Rock), a particular promontory on the Grand Canyon, a local church, a particular tree in the woodland where they walk their dog…or any other geographical feature. Once created, the password is then "salted" by adding a string of hidden random characters that are user-specific and the geographical password and the salt "hashed" together. Thus, even if two users pick the same place as their geographical password the behind-the-scenes password settings is unique to them.

If the system disallowed two users from picking the same location, this will make it much easier for adversaries to guess passwords.

The guessability, or entropy, of a geographical password would increase significantly if the password comprised two or more pinpointed locations. Al-Salloum explains that a whole-earth map might have 360 billion tiles at 20 degrees of "zoom," which offers an essentially limitless number of essentially unguessable geographical passwords.

View the original article here

Google Doodle celebrates Douglas Adams and HHGttG - remember, "DON'T PANIC!"

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Today's Google Doodle celebrates what would have been the 61st birthday of Douglas Adams, the British satirical author who gave the world The Hitchhiker's Guide to the Galaxy.

What started as a BBC radio show morphed into a book, which in turn became a series of books.

In true Adamsian style, the HHGttG series, as fans call it, is resolutely referred to as a trilogy.

(It comprises five books.)

Adams died in 2001, at just 49 years old, of a heart attack caused by an undiagnosed problem with his coronary arteries.

The HHGttG referred to in the radio show's title is a sort of intergalactic Wikipedia-meets-eBook travel guide for freeloading space travellers.

The Guide left behind a range of catch-phrases that have entered popular speech, notably amongst techies and geeks, because they apply so well to the vagaries of IT and IT support.

The best-remembered, and most frequently heard, are probably:

* Mostly harmless, which is how the Guide summarises Earth. (Even in an electronic travellers' Wikipedia, there are bound to be a few articles that are on the brief side.)

* Don't panic, written on the cover of the Guide "in large, friendly letters."

Regular Naked Security readers will have spotted irregular references to HHGttGisms in our articles, from my use of a giant DON'T PANIC logo in an article about a vulnerability that the media was blowing out of proportion, to Graham Cluley's perfectly purposeful deployment of the term hoopy frood, intergalactic slang for "cool dude."

As it happens, Graham's dip into the space traveller's argot related to another Google Doodle, back in 2010, when Google celebrated the 30th birthday of the game Pacman with a playable version on its search engine's home page.

Googlers, of course, are HHGttG fans of the first water, with an operating system distribution called Android, and even a short-lived series of mobile devices under the brand name Galaxy.

The Android in the Guide series is Marvin the Paranoid Android, a robot with a "brain the size of a planet" who is perpetually bored and depressed due to his untapped intelligence.

At a claimed 50,000 times smarter than a human and 30,000,000 times smarter than a live mattress, you can begin to see Marvin's point.

DON'T PANIC is an excellent guideline when it comes to computer security response, especially when malware is concerned.

Sometimes, what seems like an obvious response may be quite the worst thing to do.

That's been true since the earliest days of malware.

Boot sector viruses, like Michelangelo (which had its 21st anniversary just a few days ago on 06 March 2013), used to be the most common sort of infection.

And received wisdom said, "Format your hard disk - it's the quickest and easiest way to remove the virus."

Except, of course, that a regular FORMAT removed everything except the virus, which survived intact in your PC's Master Boot Sector, and could cannily outlive the reinstallation of DOS, the copying back of all your software, and the recovery of your data from backup.

Assuming you had a backup, that is.

Reimaging infected computers is much quicker and more reliable these days, but it's often overkill, and (if you need to do it en masse) can still take ages and be pretty inconvenient for your users.

Your best defence, as always, is not to get infected in the first place.

But even with the best will in the world, malware can slip through. If it does, always remember those two useful words.

Don't panic!

If in doubt, get in touch with someone you know (preferably someone you have actually met!) and trust...

Follow @duckblog

PS. I've been clicking around on the HHGttG Doodle, but I haven't yet found the button that, when pressed, illuminates a sign saying, "Do not press this button again." If there is such a click sequence, and you find it, please let us know in the comments!

View the original article here