On Sun, 2007-03-18 at 18:57 +0100, Paul Wouters wrote: > Excellent idea. Let's ditch the passphrase/pin though, because once we > copy the data off phone to another device, brute forcing anything you > can type comfortable using a pin or keyboard will be trivial.
I wouldn't. Brute-forcing a passphrase/pin is only as simple as the passphrase/pin. Plus you are limiting your thinking to the current MoKo platform (The Neo). In the future there may be MoKo devices with hardware keyboards and without touch screens. An entropy meter associated with the creation of the passphrase/pin would be very useful, as would having a high limit on the number of characters, or no limit at all. It could help people choose better passphrases, making the people more security conscious in the process. Almost all of my passwords are 15+ characters, but they are all memorable (to me) and when I've run them through stand-alone entropy meters, they all rate very highly. > I really like the "custom drawn symbol" idea. It introduces a lot of > variables. Not only the lines, but also the timestamps on when scribbling > it. Yes, lots of variables, like fuzzy-matching the symbol, because I don't know about you, but I don't think I can be pixel-perfect drawing on a touchscreen in any reasonable length of time. -KW _______________________________________________ OpenMoko community mailing list [email protected] http://lists.openmoko.org/mailman/listinfo/community
