Science & Enterprise subscription

Follow us on Twitter

  • Survey in the U.K.
    about 4 hours ago
  • The genome of the Asian giant hornet, a species threatening bees and humans, was analyzed, with the data released b…
    about 6 hours ago
  • New post on Science and Enterprise: Giant Hornet Genome Sequenced #Science #Business
    about 6 hours ago
  • A clinical trial testing stem cells from human placentas as a treatment for Covid-19 infections is expanding to thr…
    about 24 hours ago
  • New post on Science and Enterprise: Grant Funds Placenta Stem Cell Trial Sites for Covid-19 #Science #Business
    about 24 hours ago

Please share Science & Enterprise

Inkblots Add Extra Layer to Online Password Security

Sample GOTCHA inkblot

Sample GOTCHA inkblot, described as “Miss Crabtree puckers for a kiss.” (Carnegie Mellon University)

Computer scientists at Carnegie Mellon University in Pittsburgh devised a technique using inkblots to provide an extra layer of security for passwords stored for authenticating online user accounts. The developers — doctoral student Jeremiah Blocki, and faculty members Manuel Blum and Anupam Datta — described their system called Generating panOptic Turing Tests to Tell Computers and Humans Apart or GOTCHA earlier this week at Association for Computing Machinery’s Workshop on Artificial Intelligence and Security in Berlin, Germany.

Blum and colleagues at Carnegie Mellon developed the familiar CAPTCHA scrambled letter  system for filtering out automated rogue programs, when accessing online resources.

The researchers developed GOTCHA to protect high-value online data, such as those stored in financial accounts or medical records. The technique, say the researchers, requires simultaneous human and computer interaction, thus negating brute-force hacking attempts that rely on sheer computing power and speed to run through all possible character combinations to break a password.

GOTCHA creates a series of multi-colored inkblots when the customer creates a password, and the customer then adds a brief text phrase to describe each inkblot. When customers sign in again to the site and enter their passwords, the inkblots are displayed, but with the descriptions in random order. Customers must then match the phrases to the inkblots to access their accounts.

The need for simultaneous computer response and human judgement adds the robust layer of security, should a hacker steal a list of accounts with passwords encrypted in hash codes, then try to break the passwords offline. “A computer can’t do that alone,” says Datta in a university statement. “And if the computer must constantly interact with a human to solve the puzzle, it no longer can bring its brute force to bear to crack hashes.”

A test of GOTCHA, with 70 participants recruited through Mechanical Turk,’s online workforce marketplace, shows Blocki and colleagues may need to refine the system before it’s ready for large-scale use. The test asked participants to describe 10 inkblots with short, but creative titles. Ten days later, when 58 returning participants tried to match the descriptions to the inkblots, only about one-third of the group correctly matched all of the descriptions to the images. Another one-third were able to match half of the inkblots to the phrases.

Nonetheless, the researchers constructed a crowdsourcing challenge to the computer science community to try and break GOTCHA in a simulated offline dictionary attack, as might be used in a server breach.

Read more:

*     *     *



Comments are closed.