JavaScript-RGB-Password

Between stupid complexity requirements and "you can't repeat that password", I end up with "password" on one site, "Password1" on another, and "Password1!" on yet another.…

I think a better usage would be to show two patterns - one of the password being entered and another for the password on file. Salt the passwords obviously before generating a…

Nice. Note, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time, which is trivial. Don't use this if you're worried…

Assuming I record the colours generated when each character is entered, then I have a hash of just the first character. Cracking that is trivial. Then I can go and crack the…

That reduces the problem to brute-forcing the first four characters...

This is cool, but ultimately worthless- even detrimental to security. The only problem this could possibly solve is that user has to wait for a reload before trying their…

And importantly, you can't rate limit client site JS like you can server-side with captchas etc.

Why not do this with hieroglyphs instead of colours? I have deuteranomaly and colours don't work for me. I remember reading %10 of male population has some kind of colour…

Deficiency doesn't mean that he sees colours diminished in hue value, but exactly that he wouldn't be able to distinguish between some colours.

The idea is nice but in theory but that would be a _huge_ security risk. You'd be providing anyone you know with your encrypted password, as well as the encryption method.

Perhaps adding a short delay (under a second) after the last keystroke before refreshing the image would make this much more secure.

I think a better solution would be to only show the colour hash after there hasn't been a keypress in a few seconds. This would likely be a pretty good way of making sure you…

You could delay the display of the color pattern until the user has stopped keying for a second or so. That way, the shoulder surfer would not get incremental versions to work…

Why not do this with hieroglyphs instead of colours? I have deuteranomaly and colours don't work for me. I remember reading %10 of male population has some kind of colour…

That's a nicer idea. Or to generate some kind of character / robot.

Of course, my preferred solution to this problem is to allow the user to toggle the password field, so that they can view the unobscured text if they wish.

Wouldn't having a "show password" option be a lot better?

I don't understand what problem this solves. Can anyone explain?

This has been done before: http://mattt.github.com/Chroma-Hash/ Just make sure that the color thing is not reversible.

Arc90 Labs had a similar thing around the same time too: http://lab.arc90.com/2009/07/09/hashmask-another-more-secure-experiment-in-password-masking/

With more spark line: http://lab.arc90.com/2009/07/09/hashmask-another-more-secure-experiment-in-password-masking/

Lotus Notes has been doing this for years with a series of images instead of colours. It's an interesting idea but I think it's more confusing than helpful.

Mozilla worked too on visual hashing: https://wiki.mozilla.org/Identity/Watchdog/Visual_Hashing Chrome extension:…