As much as security experts would like for it to be otherwise, experience has taught us that no matter how many times some people are lectured on the use of complex passwords, a good number of them will always go for short, simple, easy-to-remember (but also to guess!) ones.

I'm not saying that we should stop trying to get the point across, but as Microsoft is working on the integration of picture passwords into its upcoming Windows 8 operating system, it is good to see that other options are being considered.

Microsoft's developers' aim was to create a fast and fluid touch sign-in experience that would feel and be personal, so they decided to make users use a picture from their picture collection.


Once the picture is chosen, the users are asked to draw three gestures - circles, lines or taps - on it, and to remember the size, position, and the direction of the gestures so that they might reproduce them later in order to sign in.

"When you draw either a circle or a line on your selected picture, Windows remembers how you drew it," explained developer Steven Sinofsky. "So, someone trying to reproduce your picture password needs to not only know the parts of the image you highlighted and the order you did it in, but also the direction and start and end points of the circles and lines that you drew."

The developers have opted not to allow freeform gestures to be included in the sign in process because they have discovered it would make it longer than it should be. Sinofsky also notes that the picture password is provided as a login mechanism in addition to the text password, not as a replacement for it, and that its use will be optional.

"In addition to the number of unique combinations, we’ve increased security of the feature by introducing two safeguards against repeated trial attacks," he explained. "Similar to the lock out feature on phones using PIN, when you enter your picture password incorrectly 5 times, you are prevented from using the feature again until you sign in with your plain text password. Also, picture password is disabled in remote and network scenarios, preventing network attacks against the feature."

To those worried that the password can be guessed by examining the smudges left by the users' fingers on the touch screen, Microsoft says: "Don't be."

"Because the order of gestures, their direction and location all matter, it makes the prospect of guessing the correct gesture set based on smudging very difficult even in the completely clean screen case, let alone on a screen that sees regular touch use," Sinofsky writes.