<div dir="ltr">I actually do prefer the monsters or unicorns > identicons<div><br></div><div>From a usability perspective, making verifying fingerprints (collecting a zoo of monsters or unicorns) isn't such a bad idea and having some attachment to your personal fingerprint.</div>
<div><br></div><div>The only concern is I think any imagery may be more difficult to have fidelity to the original fingerprint vs. something more algorithmic looking such as the Identicon.</div><div><br></div><div>In that sense, if users are scared of "fingerprint" we could also call it something like a "cryptographic avatar"</div>
<div><br></div><div>Christine<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 13, 2014 at 7:52 AM, Trevor Perrin <span dir="ltr"><<a href="mailto:trevp@trevp.net" target="_blank">trevp@trevp.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><div class="">On Wed, Mar 12, 2014 at 11:18 PM, Tom Ritter <span dir="ltr"><<a href="mailto:tom@ritter.vg" target="_blank">tom@ritter.vg</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>On 11 March 2014 00:41, Trevor Perrin <<a href="mailto:trevp@trevp.net" target="_blank">trevp@trevp.net</a>> wrote:<br>
> Fingerprint Types<br>
> - Visual and poetry fingerprints seem worth including.<br>
<br>
</div>Does anyone have a preference for type of visual fingerprint? Some of<br>
the implementations I know of are:<br>
- Identicons: <a href="http://haacked.com/archive/2007/01/22/Identicons_as_Visual_Fingerprints.aspx/" target="_blank">http://haacked.com/archive/2007/01/22/Identicons_as_Visual_Fingerprints.aspx/</a><br>
- Monsters: <a href="http://www.splitbrain.org/projects/monsterid" target="_blank">http://www.splitbrain.org/projects/monsterid</a><br>
- Wavatars: <a href="http://www.shamusyoung.com/twentysidedtale/?p=1462" target="_blank">http://www.shamusyoung.com/twentysidedtale/?p=1462</a><br>
- Unicorns (really)<br>
<a href="http://meta.stackoverflow.com/questions/37328/my-godits-full-of-unicorns" target="_blank">http://meta.stackoverflow.com/questions/37328/my-godits-full-of-unicorns</a><br>
<br>
I think I will go with identicons unless anyone really thinks unicorns<br>
is better ;)<br></blockquote><div><br></div></div><div>I think this is the most referenced:</div><div><br></div><div><div>"Hash Visualization: a New Technique to improve Real-World Security"</div></div><div><a href="https://sparrow.ece.cmu.edu/group/pub/old-pubs/validation.pdf" target="_blank">https://sparrow.ece.cmu.edu/group/pub/old-pubs/validation.pdf</a><br>
</div><div class=""><div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
As far as poetry goes, I think I missed that, couldn't see it in<br>
archives either. Is there a reference to what poetry fingerprints<br>
would look like? Is it significantly different from english words?<br></blockquote><div><br></div></div><div><a href="https://moderncrypto.org/mail-archive/messaging/2014/000125.html" target="_blank">https://moderncrypto.org/mail-archive/messaging/2014/000125.html</a><br>
</div><div class=""><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>> Modulating Speed<br>
> - For the "Spoken Aloud" test, why not just have pairs of subjects compare<br>
> the fingerprints by speaking to each other?<br>
<br>
<br>
</div>Is the idea here to make the speed at which fingerprints are read<br>
variable, but out of the control of the experiement conductor, so it's<br>
variable in a "simulating the real world" sense?<br></blockquote><div><br></div></div><div>Yeah, it seems like a more realistic test, since it allows subjects to come up with clever strategies to communicate things (e.g. a phonetic alphabet), or stumble over things (accents, getting confused over where they are in the char sequence, etc.)</div>
<div class="">
<div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
> Error Rates<br>
> - I'm not sure about the '"One Subtle Flaw" case, because the fingerprints<br>
> have different notions of "tokens" so this will be hard to compare between<br>
> formats. Also, it doesn't model a realistic attacker.<br>
<br>
</div>I agree it doesn't model a real attacker, but I thought it might help<br>
us draw conclusions better. Instead of just saying "Most users are<br>
not fooled by a 2^80 match", perhaps we can say "If users actually<br>
verify fingerprints, most are not fooled by any unmatching bytes."<br>
Across the spectrum of unmatching bytes (from all bytes unmatching to<br>
no bytes unmatching) test points along the spectrum to see if there's<br>
a dropoff. Granted we're only testing a couple points, but it seemed<br>
this was a good point on the spectrum.</blockquote><div> </div></div><div>Maybe, though I still think it's less useful than considering plausible attacks, so I wouldn't put that test as a high priority.</div><span class="HOEnZb"><font color="#888888"><div>
</div>
<div><br>
</div><div>Trevor</div><div><br></div></font></span></div></div></div>
<br>_______________________________________________<br>
Messaging mailing list<br>
<a href="mailto:Messaging@moderncrypto.org">Messaging@moderncrypto.org</a><br>
<a href="https://moderncrypto.org/mailman/listinfo/messaging" target="_blank">https://moderncrypto.org/mailman/listinfo/messaging</a><br>
<br></blockquote></div><br></div></div></div>