An unlock screen idea for the Pyra


Grench

Forum Addict!
Joined
Oct 3, 2008
Messages
6,629
I had this idea years ago when the Pandora was in development.  I still think it's a good one to consider.

Keeping your mobile device locked when not in use is generally a good idea.  The Linux login screen and having to re-type everything just to change a song (or check for a message or other) is a bit inconvenient.

We will have two nubs and four shoulder buttons.  Each nub is semi-analog.  Precise re-positioning is unlikely, we're human after all.  However, if divided into 8 directions with 10-50%, 51-90% and full 100% in that direction, each nub can generate 3 possibilities in each of 8 directions yielding 24 different combinations.

With two nubs and 24 combinations each, the nubs alone can yield 24*24 = 576 combinations.

Add in the 4 shoulder buttons - each with 2 positions.  576*2*2*2*2 = 9216 permutations.

The usual 3x3 select 4 Android lock screen is 9^4 = 6561.

A Master padlock has values 0-39 (40) and 3 positions yielding 64,000 in theory, but reality is much fewer.

A truly random 'strong' password using a standard keyboard with the 53 keys (characters, numbers and easily found symbols) and 8 entries yields 6.2*10^13.

A lock screen ins't really security so much as it deters casual nosy people.

With an option for visible feedback - i.e. a screen with the two nubs and 4 buttons and their state presented - it could be very easy to use.  Without the visible help, it could be very difficult to casually crack.

Now, the above example is with the buttons and nubs going from nothing to a single position.  Using two or more 'combinations' in series quickly becomes real security.

1 set = 9,216 permutations.  Better than the usual Android lock screen.

2 sets = 84,934,656 permutations.  Better than a Master padlock with 3 values.

3 sets = 782,757,789,696 permutations.

4 sets?  7.2*10^15 permutations.  Better than an 8 character truly random keyboard password using characters, numbers and readily available symbols.

5 sets?  6.6*10^19.  Better than an 11 character truly random keyboard password.

Each 'combination' of nubs & buttons might take someone 1 second to input - probably 1/3 second with practice.  If you're a casual user with nothing sensitive on the device, a single set could be as simple as right nub right and right top shoulder button.  If you're paranoid, 4 actions in under 2 seconds could be stronger than 90% of the passwords in the world.

All from a couple of flicks of 2 nubs and covering or not some or all of 4 buttons.

Thoughts?
 
This would only work if the SD cards weren't easily accessible... 
For the truly paranoid - and real security - SD cards and/or Linux partitions on them, can be encrypted to the user's keys.  See also Debian encrypted LVM.
 
But you would still have to press an "okay" button... Otherwise I could try a lot of possibilities quite fast with "rotating the nubs" in different distances while pressing random shoulder buttons.

Would you like to press all 4 shoulder buttons, left nubs 50% to the left top corner, the right nub 100% to the right top corner + pressing (A) for okay?

Why not much more like fight games (we have 6 action buttons!) and you have to use a combo to login like ABCXYCC<>^VA and afterwards a little dragon kick animation plays...
 
But you would still have to press an "okay" button... Otherwise I could try a lot of possibilities quite fast with "rotating the nubs" in different distances while pressing random shoulder buttons.


Would you like to press all 4 shoulder buttons, left nubs 50% to the left top corner, the right nub 100% to the right top corner + pressing (A) for okay?


Why not much more like fight games (we have 6 action buttons!) and you have to use a combo to login like ABCXYCC<>^VA and afterwards a little dragon kick animation plays...
Nope.  No need for an 'OK' button.  Unit starts in a 'ground state' with nubs at 0,0 and shoulders unpressed.  Returning it to that state is the signal that you're done with that entry.  If you went through the combination sequence during that usage, it would trigger a positive.  If you went through more than a given threshold of the necessary combinations to get to yours, it would be a negative.  I.e. randomly circling the nubs and pushing buttons would always be a negative.

In your scenario for your key, press all 4 shoulders, left nub to 50% +/- 20% and right nub to >90% then let go.  The fact that they all returned to center after is the 'OK'.

The point to this is to DECREASE the number of presses required to still get adequate security.  The 6 action buttons gives 6^(number of presses) permutations.  Add in the D pad and it's (4 + unpressed) and D pad plus combinations of action buttons and it might get it closer.  However, since each nub can have at least 24 (more in theory) positions it can provide more permutations with fewer actions than you'll ever get with the action buttons and D pad.

Taken to an extreme... With graphic feedback for the user I could see using the nubs with much finer control.  Say a 10x10 virtual grid per nub which would be 100 recordable positions per nub.  100*100*2*2*2*2 = 160,000 combinations using just the nubs and shoulder buttons on -one- entry.  Using 2 entries is 25,600,000,000 potential outcomes.

The nubs are the key to this.  They're capable of relative precision over a very broad range of values.  That's the key to generating a high number of potential outcomes to quickly pick your keys from.

Take a 6 sided die.  Each time you roll it, you have a 1:6 chance of rolling a 6.

Take two 6 sided dice.  Each time you roll the pair you have a 1:36 (1:6^2) chance of rolling a pair of 6s.

Take three 6 sided dice.  Each time you roll the set of 3 you have a 1:216 chance of rolling 3 6s.

Now envision that progression using a die with 24 sides (first example) then 100 sides (only humanly possible with screen feedback).

The nubs get us the one action result out of many possible solutions.
 
Great idea, especially if this would work in a bigger context > incorporating the specific control features the Pyra has more into the basic system. But I'm not sure, that I would be practically able to pull off that many combinations with the nubs (I'm just too clunky), and I'm with TrashyMG here > who sould write that ?
 
Just a regular password-protected lock screen (which is already available in most desktop environments) can offer more security and takes no implementation effort at all. It's probably also less frustrating and more efficient than using an analog input method to enter digital information. I rather type four alphanumerical letters (a couple of million possibilities) than to carefully fiddle with the nubs to reach some relatively specific position.
 
I imagine a lot of people would like this idea, but I'd be happy if I can just use xscreensaver.
 
So if my nubs stop working im out of luck, but if my keyboard stops working i can just plug in an usb one. Who is locking out whom?
It does not have to be 'all or nothing'.  Cake and eat is entirely possible.

Example: Biometric fingerprint login systems typically can flip to a username/password login alternative for the same account.
 
Sure, does something like that exist for xfce lockscreen/login manager ?

Edit: Im an idiot, and now understand more of what you meant. You dont have to select one or the other if both are available exclusivly, you can pick one or the other when both are available each time.
 
Last edited by a moderator:
More combinations doesn't really mean more security. It quickly becomes pointless trying to brute-force through a hardware interface.

If we really do want this, I suggest that four shoulder buttons plus eight directions on each nub = 1024 combos is easily enough.

If someone is making a concerted attempt to attack the device, the electrical interfaces (SD cards, USB, etc) are probably a far easier angle to do it from.

If they aren't that keen to break in, 1024 combinations is fine.

Whats more, for the security obsessive, a conventional password (say there are 100,000 words in English, and you pick three of them) provides far more combinations.
 
More combinations doesn't really mean more security. It quickly becomes pointless trying to brute-force through a hardware interface.

If we really do want this, I suggest that four shoulder buttons plus eight directions on each nub = 1024 combos is easily enough.

If someone is making a concerted attempt to attack the device, the electrical interfaces (SD cards, USB, etc) are probably a far easier angle to do it from.

If they aren't that keen to break in, 1024 combinations is fine.

Whats more, for the security obsessive, a conventional password (say there are 100,000 words in English, and you pick three of them) provides far more combinations.
You're ignoring that they're analog sticks and treating them as an 8 button D pad...  Part of the magic here is that a nub in 8 directions with 3 'buckets' in each direction is relatively easy to hit, but yields a relatively strong password equivalent with a single set of actions.

The whole idea is to give 'good enough' protection while not requiring the end user to enter a complex or lengthy password on a diminutive keyboard.  Three words?  That's something in the order of 20+ buttons to press - too much for a mobile device.

I suspect that most of us are using a sub-6 character password using just the top level characters on the Pandora's keyboard - if any entry/lock password at all.  The Pyra is a phone too - and needs a bit more thought to security and how to make it unobtrusive to the end user.
 
Well, my password is made up of several dictionary words. That makes it long, but easy to enter and fairly secure.
 
Well, my password is made up of several dictionary words. That makes it long, but easy to enter and fairly secure.
My guess is that you use that three word passphrase on your main computer - do you do it on your Pandora?

Do you use a -long- password that you type in on your phone?

A 20 second log in sequence can seem very tedious on a mobile device.
 
Pyra unlock Screen?

Say the Magic Words into the Micro aka "HocusPocusFidibus"

And after you say that you are in Pyra OS ;)

Mean an Audio unlocking Feature :D

Edit:And to make it very difficult for Thieves is unlocking in Bavaria German Dialect :lol:
 
Last edited by a moderator:
Well, my password is made up of several dictionary words. That makes it long, but easy to enter and fairly secure.
 
My guess is that you use that three word passphrase on your main computer - do you do it on your Pandora?


Do you use a -long- password that you type in on your phone?


A 20 second log in sequence can seem very tedious on a mobile device.
On Pandora, yes. My phone hasn't got a password.
 
Say the Magic Words into the Micro aka "HocusPocusFidibus"
That actually gives me a really good idea. Something I'm sure I can't mention right now due to working with NDAs, at least not until I've got a Pyra and can get my boss to green light a proof of concept, but know that it's really cool.THANKS!
 
I have to say that I like the idea of "combo unlock".

Actually I think that this kind of unlocking mechanism may be used also in regular PCs. There are over 50 key which may be used to enter a key combination. I guess it is safe to assume that a keyboard will recognize 4 keys pressed at once (with more keys there is a [bigger] risk that some of them won't be recognized). But even 4 keys give you a nice number of combinations. Plus as mentioned, combos may be used in series.
 
Back
Top