How Strong is PicKey’s Security?

Modern password managers rely on a Master Password to ensure user access security. In this article, we delve into the strength of the conventional Master Password and explore how PicKey’s Master Key surpasses it impressively. Let’s begin by examining the robustness of a traditional Master Password.

The usability & ease of use of PicKey remains miles ahead of any Master Password platform and is discussed separately in a different post.

Brute Force – How Strong can a traditional Master Password be?

Since traditional text-based Master Passwords have to be memorized, people often keep easy to remember Master Passwords, which in-tern could be easy to guess and brute-force into. For the sake of this discussion and to give Master Passwords a fighting chance, let us assume that the users always create strong Master Passwords that satisfy the requirements of a good password.

The minimum requirements for a good password (and master password), are :

• Be at least 12-14 characters long
• It should contain at least one of each –
  • An Uppercase letter
  • A Lowercase letter
  • A Special Character
  • A Number
• Must not have an easily guessable word in it
• Must not be similar to other passwords

Assuming that we are talking about a 14 digit password that follows all of these rules, lets delve into some probability theory and find the compute time and probability of brute forcing this password.

Total CharacterSet for Text Based Passwords

Text based passwords can only be created using the keys of the keyboard. These are :

• 26 Lowercase Letters
• 26 Uppercase Letters
• 10 Numbers
• 32 Special Characters

That is total of 94 characters.

All Possible Combinations For a Master Password

Master Passwords can only be created from a total of 94 Characters. Thereby for a 14 digit password, there are a total of 94¹⁴ combinations that are possible.

Guessing Speed for a Master Password

A typical modern GPU might be able to attempt around 10 Billion guesses per second (this assumes that we are using a high-end computing device to crack this password).

Time Required to Guess The Master Password

Time to crack a Strong Master Password = seconds.

This is roughly equal to 1.79 X 10²³ seconds, or 10¹⁵ years.

This number is the best case scenario for a Master Password, since in-practice, users do not follow good password practices as they tend to create a password that is memorable, which can also make the password easy to guess for the brute force attacker. The real number may be much smaller that 10¹⁵ .

Brute Force – How Strong is PicKey’s Master Key?

To get into low level details of PicKey’s security architecture, let us see how PicKey uses Deep Learning.

Strength of the Vision Secret

PicKey.ai uses a Deep Neural Network to compute output embeddings that resemble the properties of the picture that was used as a Vision Secret. Often this embedding could be comprised of thousands of Tensor values. For the sake of this discussion, lets keep the size of the embedding to be 2000 tensor objects.

1. The Range of Each Dimension in the Embedding : A typical Tensorflow or Pytorch tensor value is generally normalized between -1.0 and 1.0. The real tensor value range will be extremely high [for example a float tensor value space of 32-bit floating point tensor], but for simplicity, let us assume a value that falls between -1 and 1.
2. Quantize the Embedding Space : To deal with a continuous space, we would typically quantize it into a set of discrete values. The level of quantization will affect the accuracy of the brute force attack. For example, if we decide to represent each dimension of the embedding with 1000 discrete levels, this would divide the range of each dimension into 1000 parts. Technically, this space will be so large that i may be impossible for an attacker to find the actual image (2000 tensors with each being having a 32 bit float space). Let us take a quantization of 1000 parts so that:
   • We are talking about meaningful representation on the manifold of possibilities with such a high rank tensor.
   • We take a practically possible number that is acceptable to everyone .
   • Ease of calculation.
3. Calculate the possible combinations : With 2000 dimensions and 1000 levels for each dimensions, we would have 1000²⁰⁰⁰ possible combinations, with the probability of guess being:

Given that the embedding space has been quantized into possible combinations, and assuming the same GPU can make 10 billion guesses per second, we can calculate the time it would take to exhaustively search this space.

Add the Keymoji Secret

Since the Master Key is created using a personalied Keymoji, let’s assume that the total available Keymojis on PicKey’s store are just 1000.

All Possible Combinations For the Master Key

Total combinations = (number of Keymojis) x (Vision Secret Combinations)

Total combinations =

Time Required to Guess The Master Key

Taking the same GPU that can try 10 billion combinations per second :

Time to crack a Master Key =

Time to crack a Master Key ≈

This value would again be so vast it would be virtually meaningless in human terms. To make this more concrete, it would take a number of years that is many orders of magnitude greater than the age of the universe to exhaustively search through all the combinations.

Just comparing those numbers, time to find :

PicKey’s Master Key = Years

and time to find a strong Master Password = Years.

So PicKey’s Master Key is

10⁵⁹⁷⁸ times

more difficult to crack than today’s Strong Master Passwords.

That is number ten, followed by 5978 zeros.

This scale is so high that the strength of a traditional Master Password simply pales away in comparison.

Master Key’s Special Powers – Simply Untouchable

PicKey’s Master Key is not only a much better alternative to Password Managers and Master Passwords, it offers some additional & unique advantages that no other password manager possesses.

Quantum Computing Resilience

Traditional encryption methods, which often underlie password systems, can potentially be threatened by quantum computing. Quantum computers promise to solve certain mathematical problems, like factoring large numbers, much faster than classical computers — thereby potentially compromising many encryption algorithms. PicKey’s Vision Secret, being non-algorithmic and relying on the unique and vast entropy of visual data, doesn’t hinge on these solvable mathematical problems. As a result, it presents a much more complex challenge for quantum computers, ensuring greater resilience against quantum attacks.

Immunity to Rainbow Tables

Rainbow tables are precomputed tables for reversing cryptographic hash functions. A text-based password, especially if not salted, can be quickly looked up in a rainbow table. PicKey’s visual Master Key is immune to this kind of attack because each image (Vision Secret) is unique and doesn’t lend itself to precomputed tables, especially when combined with a unique 3D character (Keymoji Secret).

Immunity to Dictionary Attacks

Text-based passwords often succumb to dictionary attacks, especially if they’re based on real words or common phrases. The Master Key, given its visual nature, is not susceptible to such attacks.

Entropy and Complexity

A combination of an image and a 3D character offers a much higher entropy than any textual password used today. Higher entropy means more unpredictability and resistance to brute-force guessing.

Phishing Resilience

It’s more challenging for attackers to create phishing mechanisms for visual secrets. Traditional phishing attacks prompt users to enter their text-based passwords. Replicating a user’s specific image and 3D character combination on a fake platform is considerably more difficult.

No Repetition

Users often end up reusing passwords across platforms. A visual-based master key, especially one based on personal images, reduces the chances of password repetition across sites, especially when used with PicKey as the Password Manager.

No Human Memory Limitation

Text-based passwords that are complex enough to be secure are often hard to remember. People are inherently better at remembering visual information, allowing for a more complex but more intuitive master key.

Shoulder-Surfing Resistance

Even if someone watches you authenticate using your Master Key, replicating the exact image and 3D character combination later is much harder than remembering a typed password.

Natural Anti-keylogging

Traditional keyloggers capture keystrokes, making text-based password entry vulnerable. The Master Key, being visual-based, doesn’t suffer from this vulnerability.

Geographic and Personal Relevance

Users can choose images for places and objects with personal or geographic relevance, adding an additional layer of difficulty for potential attackers unfamiliar with the user’s personal context.

PicKey – Cosmos of Digital Cybersecurity

Armed with unparalleled security that defies the computational limits of our universe, PicKey’s Master Key stands as an indomitable titan in the realm of password managers. It’s not just about adopting the best; it’s about experiencing the future of digital safety today. Dare to elevate your protection with the unparalleled might of PicKey; after all, why settle for anything less than the absolute best the cosmos has to offer?

FAQs

1. What is the fundamental difference between PicKey’s Master Key and traditional Master Passwords?

PicKey’s Master Key utilizes a combination of a user-selected image and a 3D character (Keymoji) to create a highly secure and unique authentication method. This approach contrasts with traditional Master Passwords, which are text-based and often vulnerable to various attacks.

2. How does the Vision Secret in PicKey’s Master Key work?

The Vision Secret involves using a deep neural network to analyze a user-selected image, creating a complex and unique embedding that forms part of the Master Key. This embedding is highly secure and difficult to replicate or guess. For more information, consider reading this article.

3. What measures does PicKey take to ensure the quality of images used in the Vision Secret?

PicKey has implemented quality control measures to prevent poor-quality images from being used, which could potentially compromise the security and effectiveness of the Vision Secret.

More FAQs at PicKey.ai. Visit PicKey’s Community Forums to ask a question.

The technology featured in this article has been recognized with granted patents, while others are currently awaiting approval.