[{"data":1,"prerenderedAt":398},["ShallowReactive",2],{"project-3675061":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":43,"post_text":46,"what":47,"said":71,"maker_in_thread":201,"shape":210,"grid":215,"attempts":360,"same_week":361,"maker_shows":32,"maker_hidden":390,"reader_version":391,"card":392},"3675061","JavaScript-RGB-Password","Using a color pattern to let a user 'recognise' their password","title","Show HN: Using a color pattern to let a user 'recognise' their password","https:\u002F\u002Fgithub.com\u002Fskattyadz\u002FJavaScript-RGB-Password","github.com","skattyadz",1331118318,2012,95,62,230,1677,14,"notable","security_privacy","password entry verification","web_app",[24,25,26,27,28],"password","visual hash","color hash","password typo","javascript","curious",-0.259,{"positive":32,"neutral":33,"mixed":34,"critical":35},2,19,3,12,36,{"idea":38,"privacy":39,"design":42},{"positive":32,"critical":34},{"positive":40,"critical":41},0,7,{"positive":40,"critical":32},[44,34,34,34,34,40,44,34,40,44,34,34,44,34,34,40,34,34,34,44,40,40,40,40,45,40,40,34,44,45,44,44,34,40,40,40,34,44,44,44],1,5,"This is just a concept I made that allows a user to discern whether they have typed a password correctly before submitting. The user never sees their password, but should be able to recognise it's pattern.\n\nThoughts?",{"problem":48,"audience":56,"pricing":56,"motivation":57,"time_to_build":56,"stack":63,"openness":68,"stage":69,"team_size":70},{"value":49,"source":50,"evidence":51},"Users cannot see masked password characters, so typos are hard to spot before submitting","commenter",[52],{"id":53,"by":54,"text":55},"3675239","jawns","When you enter your password in a password field, the characters are obscured, making it harder to tell when you've made a typo. So, if your password is \"Humpty Dumpty sat on a…",null,{"value":58,"source":59,"evidence":60},"Let a user recognise whether they typed their password correctly without seeing it","maker",[61],{"id":62},"post",[64],{"value":65,"source":59,"evidence":66},"JavaScript",[67],{"id":62},"open_source","prototype","unknown",{"praise":72,"objections":84,"requests":127,"questions":160,"alternatives":168},[73],{"value":74,"source":50,"evidence":75},"Useful idea for catching typos in password fields",[76,80],{"id":77,"by":78,"text":79},"3675287","mkopinsky","Between stupid complexity requirements and \"you can't repeat that password\", I end up with \"password\" on one site, \"Password1\" on another, and \"Password1!\" on yet another.…",{"id":81,"by":82,"text":83},"3676326","huhtenberg","I think a better usage would be to show two patterns - one of the password being entered and another for the password on file. Salt the passwords obviously before generating a…",[85,99,109,120],{"value":86,"source":50,"evidence":87},"Colors leak information per keystroke, enabling brute force by shoulder surfing or video",[88,92,96],{"id":89,"by":90,"text":91},"3675107","JoachimSchipper","Nice. Note, though, that accurately capturing the colors will let a bad guy brute-force the password one character at a time, which is trivial. Don't use this if you're worried…",{"id":93,"by":94,"text":95},"3675139","CJefferson","Assuming I record the colours generated when each character is entered, then I have a hash of just the first character. Cracking that is trivial. Then I can go and crack the…",{"id":97,"by":90,"text":98},"3675177","That reduces the problem to brute-forcing the first four characters...",{"value":100,"source":50,"evidence":101},"Reduces security and is not useful; client-side code cannot be rate limited",[102,106],{"id":103,"by":104,"text":105},"3678350","ebzlo","This is cool, but ultimately worthless- even detrimental to security. The only problem this could possibly solve is that user has to wait for a reload before trying their…",{"id":107,"by":11,"text":108},"3675119","And importantly, you can't rate limit client site JS like you can server-side with captchas etc.",{"value":110,"source":50,"evidence":111},"Color-blind users may not distinguish colors",[112,116],{"id":113,"by":114,"text":115},"3675114","LaaT","Why not do this with hieroglyphs instead of colours? I have deuteranomaly and colours don't work for me. I remember reading %10 of male population has some kind of colour…",{"id":117,"by":118,"text":119},"3675271","mrleinad","Deficiency doesn't mean that he sees colours diminished in hue value, but exactly that he wouldn't be able to distinguish between some colours.",{"value":121,"source":50,"evidence":122},"Showing a password hash pattern to others would leak information",[123],{"id":124,"by":125,"text":126},"3676436","stanmancan","The idea is nice but in theory but that would be a _huge_ security risk. You'd be providing anyone you know with your encrypted password, as well as the encryption method.",[128,143,150],{"value":129,"source":50,"evidence":130},"Delay display until typing stops",[131,135,139],{"id":132,"by":133,"text":134},"3675155","rodh","Perhaps adding a short delay (under a second) after the last keystroke before refreshing the image would make this much more secure.",{"id":136,"by":137,"text":138},"3675598","burgerbrain","I think a better solution would be to only show the colour hash after there hasn't been a keypress in a few seconds. This would likely be a pretty good way of making sure you…",{"id":140,"by":141,"text":142},"3676934","cynwoody","You could delay the display of the color pattern until the user has stopped keying for a second or so. That way, the shoulder surfer would not get incremental versions to work…",{"value":144,"source":50,"evidence":145},"Use shapes or characters instead of colors",[146,147],{"id":113,"by":114,"text":115},{"id":148,"by":11,"text":149},"3675122","That's a nicer idea. Or to generate some kind of character \u002F robot.",{"value":151,"source":50,"evidence":152},"Add a show password toggle instead",[153,156],{"id":154,"by":54,"text":155},"3675242","Of course, my preferred solution to this problem is to allow the user to toggle the password field, so that they can view the unobscured text if they wish.",{"id":157,"by":158,"text":159},"3676981","astrodust","Wouldn't having a \"show password\" option be a lot better?",[161],{"value":162,"source":50,"evidence":163},"What problem does this solve?",[164],{"id":165,"by":166,"text":167},"3675202","sambeau","I don't understand what problem this solves. Can anyone explain?",[169,176,187,194],{"value":170,"source":50,"evidence":171},"Chroma-Hash",[172],{"id":173,"by":174,"text":175},"3675103","mping","This has been done before: http:\u002F\u002Fmattt.github.com\u002FChroma-Hash\u002F Just make sure that the color thing is not reversible.",{"value":177,"source":50,"evidence":178},"Arc90 HashMask",[179,183],{"id":180,"by":181,"text":182},"3675729","palmr","Arc90 Labs had a similar thing around the same time too: http:\u002F\u002Flab.arc90.com\u002F2009\u002F07\u002F09\u002Fhashmask-another-more-secure-experiment-in-password-masking\u002F",{"id":184,"by":185,"text":186},"3675435","Maci","With more spark line: http:\u002F\u002Flab.arc90.com\u002F2009\u002F07\u002F09\u002Fhashmask-another-more-secure-experiment-in-password-masking\u002F",{"value":188,"source":50,"evidence":189},"Lotus Notes image password dialog",[190],{"id":191,"by":192,"text":193},"3675081","charliesome","Lotus Notes has been doing this for years with a series of images instead of colours. It's an interesting idea but I think it's more confusing than helpful.",{"value":195,"source":50,"evidence":196},"Mozilla visual hashing",[197],{"id":198,"by":199,"text":200},"3675238","steren","Mozilla worked too on visual hashing: https:\u002F\u002Fwiki.mozilla.org\u002FIdentity\u002FWatchdog\u002FVisual_Hashing Chrome extension:…",{"comments":45,"answered":44,"key":202},[203,206,207],{"id":204,"text":205},"3675108","Ooh, that's a lot nicer. Thanks :)",{"id":107,"text":108},{"id":208,"text":209},"3675170","Why not just use a video camera to watch them type on the keyboard? Plus, mobile devices show the last character typed. You're right, but this could be avoided by (for example)…",{"commenters":211,"max_depth":212,"maker_replies":45,"first_comment_mins":213,"lifespan_hours":214},46,10,18,15,[216,218,220,222,225,229,232,234,235,238,240,241,244,248,249,250,251,253,256,258,259,261,264,266,269,272,275,277,278,279,282,285,287,290,292,294,296,299,301,304,307,310,313,314,316,317,319,320,322,325,327,330,331,333,337,339,342,345,349,352,355,358],[173,40,44,217,174,40],"project\u002Fcritical\u002Fidea",[204,40,40,219,11,44],"commenter\u002Fneutral\u002Fnone",[180,40,34,221,181,40],"project\u002Fneutral\u002Fidea",[223,40,34,221,224,40],"3676679","kappaknight",[226,44,34,227,228,40],"3675096","project\u002Fneutral\u002Fprivacy","cstuder",[230,44,34,227,231,40],"3678142","gus_massa",[89,32,34,233,90,40],"project\u002Fmixed\u002Fprivacy",[107,32,40,227,11,44],[236,32,40,219,237,40],"3675133","icebraining",[93,32,44,239,94,40],"project\u002Fcritical\u002Fprivacy",[132,32,34,227,133,40],[242,32,34,227,243,40],"3675157","budgi3",[245,32,40,246,247,40],"3675164","other\u002Fneutral\u002Fnone","sc00ter",[208,32,40,227,11,44],[97,32,44,239,90,40],[136,32,34,227,137,40],[252,32,40,219,237,40],"3675192",[254,32,34,227,255,40],"3675158","alextgordon",[257,32,44,239,90,40],"3675171",[140,32,34,227,141,40],[191,34,34,260,192,40],"project\u002Fmixed\u002Fdesign",[262,34,40,263,11,44],"3675088","project\u002Fneutral\u002Fdesign",[265,34,34,221,137,40],"3675609",[267,34,40,219,268,40],"3675116","djhworld",[270,34,40,219,271,40],"3675197","balakk",[273,34,34,221,274,40],"3675501","dbarlett",[165,276,34,221,166,40],4,[53,276,34,221,54,40],[154,276,34,263,54,40],[280,276,44,239,281,40],"3675367","city41",[283,276,40,219,284,40],"3675553","qntm",[286,276,40,219,137,40],"3675601",[288,276,40,219,289,40],"3675835","alexmuller",[291,276,40,219,137,40],"3676071",[293,276,40,219,289,40],"3676759",[295,276,40,219,137,40],"3677020",[297,276,40,219,298,40],"3676580","simonbrown",[77,276,45,300,78,40],"project\u002Fpositive\u002Fidea",[302,276,40,246,303,40],"3675336","brador",[305,276,40,246,306,40],"3675667","m3koval",[308,276,40,246,309,40],"3675772","ohgodthecat",[311,276,40,246,312,40],"3676109","drucken",[198,45,34,221,199,40],[103,315,44,239,104,40],6,[184,41,34,221,185,40],[81,318,45,300,82,40],8,[124,318,44,239,125,40],[321,318,40,219,82,40],"3676513",[113,323,44,324,114,40],9,"project\u002Fcritical\u002Fdesign",[148,323,40,326,11,44],"commenter\u002Fneutral\u002Fdesign",[328,323,34,263,329,40],"3675256","iaskwhy",[117,323,40,326,118,40],[332,323,40,326,114,40],"3675368",[334,323,40,335,336,40],"3675455","other\u002Fneutral\u002Fdesign","ydant",[338,323,40,326,114,40],"3675557",[340,323,34,263,341,40],"3675896","im3w1l",[343,212,34,260,344,40],"3675126","TobiHeidi",[346,347,44,324,348,40],"3675423",11,"kyberias",[350,347,34,221,351,40],"3676241","eieio",[353,347,44,239,354,40],"3676255","klez",[356,35,44,217,357,40],"3677560","accountoftheday",[157,359,44,217,158,40],13,[],[362,367,372,377,381,385],{"id":363,"name":364,"points":365,"category":366},"3652983","Streak.com",306,"web_saas",{"id":368,"name":369,"points":370,"category":371},"3667653","Bounce",136,"productivity",{"id":373,"name":374,"points":375,"category":376},"3653297","Subway",84,"dev_tools",{"id":378,"name":379,"points":380,"category":376},"3660556","Stash",56,{"id":382,"name":383,"points":384,"category":366},"3664769","Repp",54,{"id":386,"name":387,"points":388,"category":389},"3672039","Groove Basin",53,"creative",false,"v2",{"id":393,"name":5,"line":6,"ai":390,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":394,"top":18,"kw":395,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":396,"url":9,"mix":397,"praise":74,"objection":86,"sub":21},3675061,-0.26,[24,25,26,27,28],"1333301301331330333100005003151130003111",[32,33,34,35],1794036493836]