Geographical passwords worth their salt

February 14, 2014

It's much easier to remember a place you have visited than a long, complicated password, which is why computer scientist Ziyad Al-Salloum of ZSS-Research in Ras Al Khaimah, UAE, is developing a system he calls geographical passwords.

Writing in a freely available "open access" research paper in the International Journal of Security and Networks, Al-Salloum emphasizes how increasingly complicated our online lives are becoming with more and more accounts requiring more and more passwords. Moreover, he adds that even strong, but conventional passwords are a in the face of increasingly sophisticated "hacker" tools that can break into servers and apply brute force to reveal passwords. Indeed, over the last few years numerous major corporations and organizations - LinkedIn, Sony, the US government, Evernote, Twitter, Yahoo and many others - have had their systems compromised to different degrees and overall millions of usernames and associated passwords have been harvested and even leaked online.

Al-Salloum has devised geographical passwords as a simple yet practical approach to access credentials that could provide secure access to different entities and at the same time mitigate many of the vulnerabilities associated with current password-based schemes. The new "geo" approach exploits our remarkable ability to recall with relative ease a favorite or visited place and to use that place's specific location as the access credentials. The prototype system developed at ZSS – Research has proven itself capable of protecting a system against known password threats. "Proposing an effective replacement of conventional passwords could reduce 76% of data breaches, based on an analysis of more than 47,000 reported security incidents," Al-Salloum reports.

The geographical password system utilizes the geographical information derived from a specific memorable location around which the user has logged a drawn boundary- longitude, latitude, altitude, area of the boundary, its perimeter, sides, angles, radius and other features form the geographical password. For instance, the user might draw a six-side polygon around a such as the Eiffel Tower, Uluru (also known as Ayer's Rock), a particular promontory on the Grand Canyon, a local church, a particular tree in the woodland where they walk their dog…or any other geographical feature. Once created, the password is then "salted" by adding a string of hidden random characters that are user-specific and the geographical password and the salt "hashed" together. Thus, even if two users pick the same place as their geographical password the behind-the-scenes password settings is unique to them.

If the system disallowed two users from picking the same location, this will make it much easier for adversaries to guess passwords.

The guessability, or entropy, of a geographical password would increase significantly if the password comprised two or more pinpointed locations. Al-Salloum explains that a whole-earth map might have 360 billion tiles at 20 degrees of "zoom", which offers an essentially limitless number of essentially unguessable geographical .

Explore further: Distributed Credential Protection: Trying to beat the hackers and protect our passwords

More information: "GeoGraphical passwords" in Int. J. Security and Networks, 2014, 9, 56-62. A PDF of the peer-reviewed research paper is available via Open Access to everyone here: www.inderscience.com/admin/ospeers/getSource.php?id=64160&fid=1148952&fromonsusy=yes

Related Stories

Recommended for you

Math reveals unseen worlds of Star Wars

February 10, 2016

Using a new computer program, EPFL researchers offer unusual insight into the universe of Star Wars, which includes more than 20,000 characters spread among 640 communities over a period of 36,000 years.

Twitter lets hot tweets rise to top of timelines

February 10, 2016

Twitter revamped its timeline Wednesday, allowing the "best" tweets to rise to the top, despite warnings of a revolt from members loyal to the real-time flow of the messaging platform.

Tiny diatoms boast enormous strength

February 8, 2016

Diatoms are single-celled algae organisms, around 30 to 100 millionths of a meter in diameter, that are ubiquitous throughout the oceans. These creatures are encased within a hard shell shaped like a wide, flattened cylinder—like ...

Battery technology could charge up water desalination

February 4, 2016

The technology that charges batteries for electronic devices could provide fresh water from salty seas, says a new study by University of Illinois engineers. Electricity running through a salt water-filled battery draws the ...

1 comment

Adjust slider to filter visible comments by rank

Display comments: newest first

adam_russell_9615
not rated yet Feb 14, 2014
I strongly doubt that anyone actually remembers long passwords at all. Maybe 1 maybe 2. But in the modern age you can have several scores of passwords. You need a cheat sheet or something like that.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.