<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 12, 2014 at 11:18 PM, Tom Ritter <span dir="ltr"><<a href="mailto:tom@ritter.vg" target="_blank">tom@ritter.vg</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>On 11 March 2014 00:41, Trevor Perrin <<a href="mailto:trevp@trevp.net" target="_blank">trevp@trevp.net</a>> wrote:<br>
> Fingerprint Types<br>
> - Visual and poetry fingerprints seem worth including.<br>
<br>
</div>Does anyone have a preference for type of visual fingerprint? Some of<br>
the implementations I know of are:<br>
- Identicons: <a href="http://haacked.com/archive/2007/01/22/Identicons_as_Visual_Fingerprints.aspx/" target="_blank">http://haacked.com/archive/2007/01/22/Identicons_as_Visual_Fingerprints.aspx/</a><br>
- Monsters: <a href="http://www.splitbrain.org/projects/monsterid" target="_blank">http://www.splitbrain.org/projects/monsterid</a><br>
- Wavatars: <a href="http://www.shamusyoung.com/twentysidedtale/?p=1462" target="_blank">http://www.shamusyoung.com/twentysidedtale/?p=1462</a><br>
- Unicorns (really)<br>
<a href="http://meta.stackoverflow.com/questions/37328/my-godits-full-of-unicorns" target="_blank">http://meta.stackoverflow.com/questions/37328/my-godits-full-of-unicorns</a><br>
<br>
I think I will go with identicons unless anyone really thinks unicorns<br>
is better ;)<br></blockquote><div><br></div><div>I think this is the most referenced:</div><div><br></div><div><div>"Hash Visualization: a New Technique to improve Real-World Security"</div></div><div><a href="https://sparrow.ece.cmu.edu/group/pub/old-pubs/validation.pdf" target="_blank">https://sparrow.ece.cmu.edu/group/pub/old-pubs/validation.pdf</a><br>
</div><div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
As far as poetry goes, I think I missed that, couldn't see it in<br>
archives either. Is there a reference to what poetry fingerprints<br>
would look like? Is it significantly different from english words?<br></blockquote><div><br></div><div><a href="https://moderncrypto.org/mail-archive/messaging/2014/000125.html" target="_blank">https://moderncrypto.org/mail-archive/messaging/2014/000125.html</a><br>
</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>> Modulating Speed<br>
> - For the "Spoken Aloud" test, why not just have pairs of subjects compare<br>
> the fingerprints by speaking to each other?<br>
<br>
<br>
</div>Is the idea here to make the speed at which fingerprints are read<br>
variable, but out of the control of the experiement conductor, so it's<br>
variable in a "simulating the real world" sense?<br></blockquote><div><br></div><div>Yeah, it seems like a more realistic test, since it allows subjects to come up with clever strategies to communicate things (e.g. a phonetic alphabet), or stumble over things (accents, getting confused over where they are in the char sequence, etc.)</div>
<div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
> Error Rates<br>
> - I'm not sure about the '"One Subtle Flaw" case, because the fingerprints<br>
> have different notions of "tokens" so this will be hard to compare between<br>
> formats. Also, it doesn't model a realistic attacker.<br>
<br>
</div>I agree it doesn't model a real attacker, but I thought it might help<br>
us draw conclusions better. Instead of just saying "Most users are<br>
not fooled by a 2^80 match", perhaps we can say "If users actually<br>
verify fingerprints, most are not fooled by any unmatching bytes."<br>
Across the spectrum of unmatching bytes (from all bytes unmatching to<br>
no bytes unmatching) test points along the spectrum to see if there's<br>
a dropoff. Granted we're only testing a couple points, but it seemed<br>
this was a good point on the spectrum.</blockquote><div> </div><div>Maybe, though I still think it's less useful than considering plausible attacks, so I wouldn't put that test as a high priority.</div><div> </div>
<div><br>
</div><div>Trevor</div><div><br></div></div></div></div>