Monday, December 23, 2013

Preventing weak passwords by reading your mind

Choosing an effective password that’s easy to remember and type, as well as hard to guess for would-be fraudsters, is a perennial problem. But it’s one that the folks at Microsoft Research are trying to tackle with an experimental tool called Telepathwords.

Telepathwords: This tool from Microsoft tells you how bad your passwords are by guessing the next letter

Microsoft's 'prediction engine' uses a very large database of words so it's not sent to your computer when you use Telepathwords. However the passwords you type and test are not logged by Microsoft but it does record data of "mouse movements and the timings of when characters are added to or removed from your password," for its research into understanding how users choose passwords. This log is encrypted before being sent to Microsoft.

While the researchers are pretty proud of the Telepathwords tool they are the first to admit that it can't prevent all weak passwords. For instance the researchers suggest that an attacker might know some of your personal information from some other source, which makes your password more guessable to them.

Experimental project Telepathwords detects how risky passcodes are by predicting your password setting habits. The engine utilises a collection of passwords in its database along with an AI to make accurate predictions.

The tool was tested by hundreds of Microsoft employees before release and is now available to the public.

You can visit the project site for yourself and see how predictable your own passwords are. For example, if you think a clever password would be p@$$w0rd, think again – the tool guesses it right instantly. If your password is zxserisljeerouiaer2345, on the other hand, its telepathic propensity flounders.