PicKey – Managing Passwords with AI, Visually

Hacker News

Share card

PicKey – Managing Passwords with AI, Visually

Hello HN, With about 24% of internet users using passwords like "password123" and "123456", we wanted to create a visually-based alternative without compromising on security. Humans remember visuals much better than text, and so we've created a password manager that uses a combination of a personal image and a 3D character (superimposed on the image) as the master password that one can see with their own eyes, making it visually recallable with a much lower cognitive load while making it stronger than text-based passwords. We call this visual master password as the Master Key. It is made of 2 parts: Part 1 - a picture of a favorite place, a cherished object, or a face (Vision Secret): PicKey uses general adaptive recognition backed by multiple neural networks that are trained to recognize places, faces, objects, etc., adapting to physical changes (view angle, lighting, seasons, age, etc.). To a user, this means that they could turn their living room into a master password, or their pet, or their favorite spot in the park, or that painting on the wall. The possibilities are endless. The Vision Secret captures high entropy from the personal nature of choices that people make and anonymizes the secret. Part 2 - a 3D character (Keymoji Secret): A virtual, 3D character can then be selected from a growing catalogue. This has lower entropy, but the main focus here is to engage our remembrance. The 3D character is often animated and has music/sound and can be viewed in 3D or in Augmented Reality. Continuing with the examples above, a user could have a roaring t-rex in their living room, or a butterfly flapping over their pet, or an alien at that spot in the park, or a hummingbird hovering in front of their paining on the wall. This combination forms the Master Key and is used to login to PicKey. PicKey then works like any password manager, capturing, autofilling & managing passwords & more; across platforms. Safety: - E2E encryption as default, AES-256/GCM/CBC, multi-hashing, salting, time gaps, ZKP, KDF, 2FA, OAuth2 - Cryptographically secure key, IV and ID generation - MagicPass - storage free passwords that are never stored anywhere; regenerated at runtime from the vision vector and a specialized hash function. Misc: - Master keys are anonymous; even a public social media post can serve as the master password. Anything memorable visually can become a master key, aiming to mimic adaptive human photographic memory and its uniqueness. - the master key login is generally long lived and manages the session based on frequency of use. - we recommend live retaking of the 'Vision Secret' at login, enhancing security. For ease, users can choose easily accessible or memorable live images, a familiar online image, or their cherished object/place, or even their face (not recommended for anonymity); ensuring consistent and secure access. - a picture based password gains resistance to traditional attacks on regular passwords like dictionary attacks, rainbow tables, keylogging etc, though the neural networks have to be hardened for new types on attacks on them. - PicKey neither collects, nor stores any personally identifiable info. References: Picture Superiority Study - https://pubmed.ncbi.nlm.nih.gov/30756412 , 24% people with passwords as "123456" - https://webtribunal.net/blog/password-stats Supported Platforms: - Mobile * iPhones > 7, iOS > 14.0. iOS Autofill, biometrics and keystore integration. * Android > v7.0 Android autofill, biometrics and keystore integration. - Desktop * Currently supported for password management - Chrome, Firefox, Edge and Safari. * To login on the browser, one must be logged into the mobile app first Next Plans: - Large Vision Models - Passkey integration - Incorporating feedback Links: - Website : https://pickey.ai - 3D login explained : https://blog.pickey.ai/login-sign-up-tutorial-for-ios/ - Short overview : https://youtu.be/KedRFg-Qg_Y