可以使用什么机制在智能手机上轻松生成高熵密码，而无需求助于字母数字输入？
我正在开发适用于 Android 的密码安全版本。密码保险箱使用密码来加密您的密码，但在智能手机上输入长密码可能会很乏味，尤其是在被屏蔽的情况下。我想研究使用密码短语的替代方案，例如简单图像数组。
有此类密码方法的好例子吗？什么样的图像最好？ 齐纳卡似乎是一个不错的选择，但似乎不适合助记设备，当然不是为了获得强密码所需的值的数量。
编辑： 一些戒律可能会有所帮助。密码安全的要点在于，包含密码的文件是使用从不存储的强密钥进行加密的。在 PC 上，这个强密钥是您在想要解锁保险箱时输入的短语或单词的加密哈希值。保险箱会自动“忘记”您提供的密码，并在 X 分钟后删除所有未加密版本的数据，这样您就不会受到攻击。
理想情况下，我希望看到一种密码安全版本，可以使用两个同样强大的密钥之一进行解密，其中一个密钥适合字母数字键盘，而另一个密钥则可以回答问题。
到目前为止，我想到的最好的想法是允许用户输入可以创建画画的短语，并让基于图像的画画条目成为最终的输入方法。
I'm working on a version of Password Safe for android. Password Safe uses a passphrase to encrypt your passwords, but typing out long passphrases on a smartphone can be tedious, especially if they're masked. I'd like to investigate using alternatives to a passphrase, such as arrays of simple images.
Are there any good examples of such password methods? What kinds of images are best? Zener Cards seem like a good choice but don't seem to lend themselves to mnemonic devices, certainly not for the number of values you'd need to get a strong passphrase.
EDIT:
Some precepts might help. The point of password safe is that the file containing the passwords is encrypted with a strong key that is never stored. On a PC this strong key is a cryptographic hash of a phrase or word you enter when you want to unlock the safe. The safe automatically 'forgets' the password you gave it and drops all the unencrypted versions of the data after X minutes so that you're not vulnerable.
Ideally, I'd like to see a version of password safe that can be decrypted with one of two equally strong keys, with one of the keys being suited to an alphanumeric keyboard, while the other one would be the answer to the question.
So far the best idea I've come up with is to allow a user to enter a phrase for which a rebus could be created, and have an image based rebus entry be the resulting input method.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果你能发明一些物理震动模式识别，那就太棒了。我一直想要这样。
If you could invent some physical shake pattern recognition, it would be amazing. I've always wanted that.
您必须克服的一个大问题是，触摸屏在使用时往往会留下污迹，如果不小心，这些污迹就会泄露有关密码的信息。避免这种情况的一种常见技术是重新排列每个输入上的按键，但这会大大减慢输入速度，因为用户必须仔细查看才能找出所需的数字在哪里。
我建议的另一种选择是使用带有相对较少选项的长密码，这样任何给定的密码都将使用大部分或全部选项，这意味着您无法从污迹中辨别出任何有用的信息。
确切的机制是什么仍然是一个很好的问题，但我不认为长数字引脚是不可能的。
One big problem you have to overcome is that touch screens tend to leave smudges when used, and without care, those will give away information about the password. One common technique to avoid this is to rearrange the keys on each input, but that slows down entry a lot, as users have to look carefully to figure out where the requisite digit is.
The alternative, which I'd suggest, would be to use a long passphrase with a relatively small number of options, so that any given passphrase will use most or all of the options, meaning you can't tell anything useful from the smudges.
What that exact mechanism is is still a very good question, but I don't think a long numeric pin would be out of the question.
目标是向可以记录错误尝试的程序或设备证明自己的身份，还是提供可以在不通知受信任方的情况下进行验证的秘密？前一种情况所需的熵水平远低于后者。
Is the goal to prove one's identity to a program or device that can log false attempts, or to provide a secret which could be validated without informing a trusted party? The level of entropy required for the former scenario is much less than for the latter.
您是否看过Droid 锁屏？ 您可以使用它作为想法的基础。
这个特殊的想法使用一系列互连的点作为密码短语，但一个简单的选项可以是一组类似于某些自行车锁的开关（复选框）。
PS 这种安全方法（Droid Lock Screen）的一大优点是输入速度非常快。您只需一笔即可完成（尽管图像显示了非常复杂的一笔。）
Have you seen the Droid lock screen? You could use that as a base for ideas.
This particular idea uses a series of interconnected points as a pass phrase but a simple option could be a set of toggles (check boxes) similar to some bike locks.
P.S. One great thing about this type of security method (Droid Lock Screen) is that the input is very fast. You can get through with a single stroke (though the image shows a very complex one.)