Security fail

[unixronin]

A Cambridge, UK outfit called Gridsure wants to solve the problem of thieves shoulder-surfing your PIN.  Their solution is this:  Instead of keying in your PIN on a keypad that displays the same digits every time, they're going to display a "keypad" filled with random digits, and defeat shoulder-surfers because the random digits are a red herring — what matters is the pattern of keys that you hit.  So, instead of the insecure and easily shoulder-surfed system of you hitting the same keys on a keypad every time you enter your PIN, they're going to deploy a clever new system wherein you hit the same keys on a keypad every time you enter your PIN, which will completely defeat shoulder-surfing.

... No, it doesn't make any sense to me either.  Didn't anyone at Gridsure stop and think for a moment about whether this hare-brained idea even made sense?

Correction, 2010.01.27:

It transpires that the article I read that mentioned GrIDsure managed to omit a crucial detail that completely changes the strength of the technology.  Please see my followup today for details.

Comments

[vetpsychwars.livejournal.com]

PIN length is actually 6 digits, but no one seems to do more than 4.

[unixronin.livejournal.com]

Wells Fargo USED to allow 6-digit PINs. Then one day they stopped, without ever giving any clear explanation as to why.