So here’s a question. How can Vidoop claim to be resistant to hacking when there’s this really obvious man-in-the-middle attack that can be executed on it? (After all, I believe it’s been suggested that we’ve all been “viduped”) First, it’s important (though I would have thought unnecessary) to bring up the word “resistant.” We say that Vidoop resists hacking because it’s harder to hack than usernames and passwords but does not actually defeat hacking wholesale.

Nothing can defeat hacking wholesale; there’s no authentication or authorization technology that is impervious to attack. Vidoop resists some man-in-the-middle attacks, largely shielding the user from automated hacking. But we also acknowledge that there are attacks that we can’t prevent.

A direct combination of a phishing and man-in-the-middle attack was demonstrated in a video not long ago, an attack that relies upon a user failing to recognize a suspicious email, then failing to realize that the e-mail is suspicious, that his computer should already be activated, that the site asking for activation is not legitimate and the URL is wrong, that SSL/TLS is disabled (a failure to “look for the lock”), that another computer has been activated on his account, and that there is likely a concurrent login to the site he is visiting. Though this is neither impossible nor even improbable for less seasoned users, it is a vulnerability to which every authentication scheme without major usability barriers offers equal or lesser resistance than Vidoop Secure.

Furthermore, even when the raw data is available to the man in the middle, the presence of a human familiar with the image categories would be necessary in order to distill the surveillance into useful information for later login attempts. Attacking Vidoop users’ login information en masse is much more difficult than with usernames and passwords because of the burden of human cognition on the hackers. There is also an additional burden of intermediate storage. While the automated system collects login session traffic, it must store the images of the grid as well as the username and one-time access code somewhere for a human to guess at the categories later.

Alternatively, suppose that a thousand users have, through lapses in vigilance, had their information compromised by this MITM-phishing attack. The hacker may just want to take the automated approach, trying random guessing at the grid to avoid having to actually engage himself in the process.

Let’s say the hacker is attacking myVidoop.com, where the chances of guessing the grid are 1 in 55 before you’re locked out. Now, even if he employs a perfect OCR (optical character recognition) to determine which letters are actually choices on the grid, the hacker will only get one in every 73 of those 1000 users whose grids he has access to. That’s 18 users. Without OCR, the odds become 1 in 650, which would mean that likely only one or two users would be compromised.

That’s pretty amazing, isn’t it? Only 1.8% (0.15% without OCR) of users whose credentials have been totally stolen will actually have their identities compromised by an automated system. If they had been using passwords, all 1,000 users would have been totally compromised. With myVidoop.com’s configuration, somewhere between 1 and 14 likely would have. Hardly an indictment. More like a vindication.

One more thing. Check out this ha.ckers.org interview with an 18-year-old phisher who makes thousands of dollars a day by stealing passwords and account details and selling them. The kind of things he does have everything to do with that return login — the one that he would get 1.4% of the time with guessing at the grid!

I think that’s enough for now, but I want to invite people to make more videos, to ask more questions, to bring things to Vidoop and to me, because I’m really interested in seeing how our solution stacks up. We’re pretty sure we’ve got something special here, and it’s exciting to see people play with it and see what they can come up with. So get on myVidoop.com, play around, try to automatically log in, try to steal your own categories, and have fun.

Until next time,
George