Hacker News new | ask | show | jobs
by nullc 3603 days ago
My WAG at this problem a few years ago: https://en.bitcoin.it/wiki/User:Gmaxwell/visual_fingerprint_...
1 comments

I'd really want to see that technique studied on actual users before trusting it. I'm not convinced that users do anything more than glance at one or two characters in hex passwords and even SSH's visual fingerprints are probably insufficiently studied (but not totally unstudied[0]) to allow telling users that glancing is enough. And if glancing isn't enough, using visual indicators at all is probably actively harmful.

[0]: http://dirk-loss.de/sshvis/drunken_bishop.pdf

In fact, I declined to post the implementation for that reason.

I'm not sure if you read my writeup but I attempted to address that "users only glance at one or two characters" by suggesting the client show the users which characters to compare. It's a little kludgy with a text UI, however.

The idea is that the field of characters is large enough that comparing only a few is fine-- so long as they're selected in a way which isn't predictable to the attacker.