Microsoft took the time to detail its Windows 8 picture password feature on Friday.
The picture password feature allows Windows 8 users to select their own personal picture and sketch three different patterns over the picture to login. The new authentication system makes it easier for tablet and touch users to login to a Windows 8 PC. Microsoft filed a patent for the feature in February, 2008. The feature works by dividing the image into a grid. “The longest dimension of the image is divided into 100 segments,” says Microsoft’s Zach Pace in a blog post on Friday. “The shorter dimension is then divided on that scale to create the grid upon which you draw gestures.” The result allows Windows 8 users to pick a photo and draw gestures over it to sign-in to their account. Gestures can include lines, circles and taps. Microsoft considered the amount of gestures required by analysing the different combinations required to create a secure environment.
“Picture password is provided as a login mechanism in addition to your text password, not as a replacement for it,” notes Pace. “You should be sure to have a good hint and use safeguarding mechanisms for your text password, which you can still always use to sign in.” Microsoft also detailed concerns over smudges visible on touch screens that could reveal picture or PIN based passwords. The software maker assessed a variety of methods to obtain the PIN or picture password sequence on a clean screen with only the gestures visible via smudging. The number of ways for ordering a 4 digit PIN is 24 according to Microsoft, if an attacker is able to see where all four smudges are present on the screen. This is improved to 48 combinations based on line and circle gestures.
“Although we’re very happy with the robustness of a picture password, we know that there are a variety of businesses for which security is paramount,” admitted Pace. “We’ve implemented group policy that gives a domain administrator the freedom to choose whether picture password can be used. And of course, on your home PC, picture password is optional as well.”