Feeds

Winfrasoft touts pattern-based password alternative

Sudoku for secure remote access

Seven Steps to Software Security

UK software developer Winfrasoft is pushing visual patterns as an alternative to traditional passwords.

Users would select, or be allocated, a pattern of squares on a six-by-six grid. Each time they logged onto a system, they would be presented with a grid of numbers (as illustrated here), from which they would have to enter the digits that correspond to their memorised visual pattern.

The numbers in the grid users are offered changes every 60 seconds, while the position of the squares in their memorised pattern remains the same. Winfrasoft execs said people find patterns easier to remember than PINs and passwords, which seems plausible enough, even though the firm wasn't able to point to secondary evidence in support of this point. "Lots of people are visual and remember patterns better than password or code," Steven Hope, a director at Winfrasoft told El Reg

The firm says the system offers a defence against phishing, pattern-cracking, screen-scraping or replay attacks, without the need for expensive hardware tokens or card readers. "An eavesdropper would have no idea of the pattern a user had selected even if they shoulder surfed," Hope added.

Winfrasoft is initially targeting the remote access market with its matrix-pattern authentication technology, via a product called AuthCentral and a corresponding mobile phone login appliance sibling, dubbed ActiveSync Gateway. At launch, this mobile technology only works with Windows-based mobile phones but the firm is also working on versions that support iPhone, Blackberry and Android.

The technology comes in various flavours and configurations. The basic 6x6 matrix can be extended to 10x10. The technology can be used as a web-based login system or, for added security, logins can be made only via a pre-authorised device. In addition, AuthCentral offers a static PIN option, which allows users to increase security by inserting an additional fixed PIN code. This PIN number can be inserted either before or after they input the numbers corresponding to their matrix pattern.

We're assured some fiendishly complicated sums are involved in making sense of this at the server end.

This pin+ technology appears to us to be the main difference between Winfrasoft and GRIDsure, another UK developer that has also been targeting the remote access market with an alternative to passwords. In GRIDsure's case, this entails a memorised pattern mapped onto a grid of numbers and letters. GRIDSure also offers its technology as a means for secure logins for Windows machines onto intranets, a market not currently on Winfrasoft's roadmap.

Winfrasoft's tech plugs into Microsoft UAG (Universal Access Gateway) while GRIDSure also supports SSL VPN platforms from the likes of Juniper.

Winfrasoft's main business involves developing security add-ons for Microsoft server-based security products.

Winfrasoft has applied for a patent for its technology and hopes to create an "eco-system of pattern-based authentication". In particular, it wants to license its technology to software-as-a-service outfits, which would re-sell it to businesses for secure access to Exchange email servers or SSL VPNs, for example. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.