Comments on: Using captcha instead of usernames and passwords http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/ A miscellany of know-it-all-isms by Geoff Sowrey Fri, 06 Jan 2012 04:27:17 +0000 hourly 1 By: Geoff http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/#comment-1677 Geoff Thu, 26 Apr 2007 15:05:51 +0000 http://www.sowrey.org/2007/04/18/using-captcha-instead-of-usernames-and-passwords/#comment-1677 If we always stick the "tried and true", there's never any change for improvement. Frankly, I think Vidoop sounds like an improvement over our decades-old text-based system. It's prone to error and security issues, and as we move forward with technology, other solutions make more sense. I think Vidoop sounds like a good solution. Assuming SOX doesn't prevent it, that is. ;) If we always stick the “tried and true”, there’s never any change for improvement. Frankly, I think Vidoop sounds like an improvement over our decades-old text-based system. It’s prone to error and security issues, and as we move forward with technology, other solutions make more sense. I think Vidoop sounds like a good solution.

Assuming SOX doesn’t prevent it, that is. ;)

]]> By: Koesmanto Bong http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/#comment-1676 Koesmanto Bong Thu, 26 Apr 2007 14:26:34 +0000 http://www.sowrey.org/2007/04/18/using-captcha-instead-of-usernames-and-passwords/#comment-1676 Thank you for blogging about us :-) you have my email address if you'd like some invite codes. (koesmanto |dot| bong |at| vidoop |dot| com) Thank you for blogging about us :-) you have my email address if you’d like some invite codes. (koesmanto |dot| bong |at| vidoop |dot| com)

]]> By: Geoff http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/#comment-1668 Geoff Wed, 25 Apr 2007 02:59:59 +0000 http://www.sowrey.org/2007/04/18/using-captcha-instead-of-usernames-and-passwords/#comment-1668 Koesmanto, thank you very much for the extra information! This helps understand the system a lot more. I think I might hit you up for a trial, too. Koesmanto, thank you very much for the extra information! This helps understand the system a lot more. I think I might hit you up for a trial, too.

]]> By: Koesmanto Bong http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/#comment-1665 Koesmanto Bong Tue, 24 Apr 2007 19:42:58 +0000 http://www.sowrey.org/2007/04/18/using-captcha-instead-of-usernames-and-passwords/#comment-1665 Hey, To answer your questions, the size of the grid can be changed. the demo showed a 3x3 grid, while on myvidoop it's a 3x4 grid. you can also customize whether or not sequencing matters; you can turn on case sensitivity, adding numbers, or even have more than 1 alphanumeric character per image. Now, onto statistics: On a 3x4 grid, where you have 3 secret categories and sequencing isn't enforced, the probability of someone guessing your secrets is 1 in 73 attempts. When sequencing matters, it is 1 in 440 attempts. On a 4x4 grid, it increases to 1 in 187 attempts when sequencing doesn't matter, and 1 in 607 attempts when sequencing matters. (assuming 3 secret categories needed). On myVidoop, we allow 3 failures before an account lockout. The above scenario also assumes that someone actually uses computers that you have activated. if they are trying to see your grid on an unactivated computer, they'd have to have access to your email address or your phone. Please let me know if you have any more questions or feedbacks. I would be happy to give you an invitation code if you'd like to try myVidoop out. Hey,

To answer your questions, the size of the grid can be changed. the demo showed a 3×3 grid, while on myvidoop it’s a 3×4 grid. you can also customize whether or not sequencing matters; you can turn on case sensitivity, adding numbers, or even have more than 1 alphanumeric character per image.

Now, onto statistics:

On a 3×4 grid, where you have 3 secret categories and sequencing isn’t enforced, the probability of someone guessing your secrets is 1 in 73 attempts. When sequencing matters, it is 1 in 440 attempts.

On a 4×4 grid, it increases to 1 in 187 attempts when sequencing doesn’t matter, and 1 in 607 attempts when sequencing matters. (assuming 3 secret categories needed).

On myVidoop, we allow 3 failures before an account lockout.

The above scenario also assumes that someone actually uses computers that you have activated. if they are trying to see your grid on an unactivated computer, they’d have to have access to your email address or your phone.

Please let me know if you have any more questions or feedbacks. I would be happy to give you an invitation code if you’d like to try myVidoop out.

]]> By: Andre http://www.sowrey.org/2007/04/using-captcha-instead-of-usernames-and-passwords/#comment-1653 Andre Wed, 18 Apr 2007 19:53:26 +0000 http://www.sowrey.org/2007/04/18/using-captcha-instead-of-usernames-and-passwords/#comment-1653 Did you give their OpenID implementation a try? Based on talking to a couple of people at the booth it appears that the demo only scratches the surface and you can scale up in terms of categories and images. They have a team made up of people from the Navy, Microsoft, and a number of other hard core organizations so if they are not SOX compliant at this second I'm sure they are on the way. Considering banks are one of their target markets and all. They did stress that they are a security company that leverages the goodness adn freshness of web 2.0 and not the other way around. Did you give their OpenID implementation a try?

Based on talking to a couple of people at the booth it appears that the demo only scratches the surface and you can scale up in terms of categories and images. They have a team made up of people from the Navy, Microsoft, and a number of other hard core organizations so if they are not SOX compliant at this second I’m sure they are on the way. Considering banks are one of their target markets and all.

They did stress that they are a security company that leverages the goodness adn freshness of web 2.0 and not the other way around.

]]>