Windows 8 is now offering picture-gesture password, Technology ,

Could this be a turning point in way we creat passwords?I don’t think sobut now Microsoft will tackle weak and fiddly alphanumeric passwords in Windows8 by introducing a secondary login process that relies on taps, lines andcircles.The sign-in will be available on desktops and aims to offer a fastersign-in with stronger passwords than using a tablet's soft keyboard.Accordingto my knowledge, a three-character password has 81,120 possible combinations,while a three-gesture picture password offers over 1.15 billion in Microsoft'sanalysis.Four gestures produces 612 billion combinations, while five createsover 389 trillion. By contrast, five random characters only has 182 millionpossible combinations.

The setup process involves selecting a personal photo and recording aset of gestures that the user must repeat to gain access. The password includeswhere on the frame a tap is located, as well as the direction that lines andcircles are drawn in. To be clear, picture password is provided as a loginmechanism in addition to your text password, not as a replacement for it.The feature is disabled after five wrong attempts at which point thesign-in process falls back to the underlying plain text password. The processis only designed for physical access.

A potential weakness of gestures aresmudges left on the screen, which could give away enough for an attacker toguess it, but Pace argued the directional element of gestures offer a fargreater number of permutations to a password combination.Lines and circles,according to Pace, become the equivalent of using a Shift key while typing in apassword.For compliant passwords, a person will typically use the Shift key to selectalternate character sets.This key press will, of course also be visible to theattacker, but it does not indicate when in the sequence the Shift key wasutilized.

For every circle and line used in the gesture set, the number ofpermutations increases by a factor of two.A smudge-visible four character PIN,password or purely tap-based gesture has 24 permutations. Adding a shift boostsit up to 96 while a four-gesture line and circle sign-in has 384 possiblecombinations, Pace noted.I am elated that Windows 8 will offer domain administrators the choiceto disable the picture password.