Alice has a picture-based password system, where she has each user pick a set of their 20 favorite pictures, say, of cats, dogs, cars, etc. To login, a user is shown a series of pictures in pairs—one on the left and one on the right. In each pair, the user has to pick the one that is in his set of favorites. If the user picks the correct 20 out of the 40 he is shown (as 20 pairs), then the

Question

system logs him in. Analyze the security of this system, including the size of the search space. Is it more secure than a standard password system?

What will be an ideal response?

Answer 1

There are two pictures for each choice, one on the left and one on the right.
Thus, with 20 pairs, there is a search space of 220, which is roughly 1,000,000. This is roughly
as secure than a standard password, for which there are dictionaries with 500,000 passwords
that can be used in dictionary attacks. If the number of picture pairs is increased to 40,
however, then the security is much higher. Of course, even picking one of 20 picture pairs
requires 20 mouse clicks, which would take longer than typing in a traditional password.