Startup Replacing Passwords With Patterns (Shayype)

By: Brian Rhodes, Published on Jun 28, 2017

This startup, Shayype, aims to eliminate passwords, replacing them with patterns.

Problems with passwords are clear, as simple passwords, re-used passwords, brute force attacks on passwords, etc. create significant problems.

But can 'patterns' fix this problem?

Inside this report, we share our test findings on Shayype's approach.

**** *******, *******, **** ** ********* *********, replacing **** **** ********.

******** **** ********* *** clear, ** ****** *********, re-used *********, ***** ***** attacks ** *********, ***. create *********** ********.

*** *** '********' *** this *******?

****** **** ******, ** share *** **** ******** on *******'* ********.

[***************]

Uses ********, *** *******

****** **** * ***** password ** ***,*********** * ****** ** changing ******* **** ********** to ***** ** *** display. ** ***** *********, the **** ***** ** the ******** ******* ********* the ***** ** * sequence ******* **** **** previously *******.

*** ********* ***** ***** example ********* *** ***** of *** ******** ***** composing * ******* ********:

*** *** ** *** pattern's ********, ** **** future ********* **** *** entirely ********* *******. *** ********* refreshes / ****** ******* every **** ********* **** the ****** ** *****:

******* ****** **** *** matrix ****** '*.* ******* possible ******** ** *** 6x6 ****** (** *** use *** **** *****)', and **** ** '**** if ******* ***** *** same *******, **** *********** of ******* *** ****-**** will ** *********', ********* in * ****** ********, single *** '****' ******* of * ********.

********** * *******, ** forgetting * *** *** that ******, ******* ******* or ******** ******* ** reset **. ** *** case ** *******'* **** website, **** **** * reset **** ***** ***** chose * *** *******.

Overview *****

** *** ***** *****, we **** *** ******* ***** and *** ** ** ********* than ******** ***** **************:

Claimed **********

******* ****** **** ******* one **** ***** ****** be ****** *** ********** patterns ** ******* *** not **** ** *****, their ****** ** **** secure. ** ******** ** the ******* ******** *** password, ******* ****** ******* other ********** **** ******** passwords, *********:

  • ** ****** '*****': **** *******, ***** do *** **** ** touch *** ******, ** fixed ******* ******* ** enter * ****, *** only *** *** ******* with ***** **** *** enter ** ***** * separate ******.  **** ** different **** *********** ******* where **** ****, ********* use ** **** ******** buttons *** ****** ****** or ****, '*******' ********* threats ***** ******* *** used *** ***** ******. Shayype's *** ****** *** a **** ** ******* buttons ** *** **** that ** *** **** someone ******** ** **** of *** ******* ***** used.
  • ****-**-*****: ** *** ********* values *** ******* * - *, **** ***** is ******** ******** ***** on *** ******, ******* complicating *******.  ** ******* sees * **** ***** entered, ** ***** *********** be ******* ********* ********.
  • ******* ************: **** ** ***** prefer ****** ********, **** 'L- ******' ** '**** corners', *** ***** *** pattern ** ******* **** also ** *****, ** moving **** *****-**-****, ** leaving * ***, ** pressing *** **** **** twice **** ** *** obscurity ** * ******** roster ** ******. ********, key ******* ** ****** passwords *** ******* ** themselves, ** *** ****** they ******* ** **** symbolic ** * ******** pattern *** ********* *********.

Online ****

*** ******* ***** *'***** ** *******' ******* ***** *******. **** users ****** ***** *********, Shayype ******* ** ******* page ********** *** *** *** how ******** *** ********** *** *** *** system ***** **********.

***********

*** *** ******* ********, Shayype's ****** **** **** drawbacks, ********** *** *** physical ******** ******. *** top **** *******:

  • ** ******* ***: ******* ** ***** an **** **** * very ***** ***-****** **********, and *** *** *** been ******* ** ******** in ** *** ********. While * ********** ****, the ******** ***** *** history *** *** ******* lacks ********** ** ********** use *** **********.
  • ******** ***** ********: ***** **** ********* to ******* **** ****, Shayype ******** *** ***** be ********* ** ******** out *** ***** ** unauthorized *****. **** ***** that ************* ******** ** codes *** ** *******, but ********* ********** ***** can ***** ***** ***** codes.
  • *****-***** ****: ******* ** ***** developed ** *** **-********** from ******* ******** ******** or *************,*** **** ********** ** marketing *** ***************** *** ***** ********* ********* ******** **** Philips, *****, ***, *** T-Mobile. *******, ******* *** have *********** ********** ******** new ******** ** ****** or ********** *** ******** through ******* ******.

Vote / ****

Versus ************

*** ******** ******** ************, Shayype ***** ** ** interesting *** *** ******** access ******* ** ******* for *** ** ****** readers.  ****** **** ******* stagnant **** **** *** quickly ** ********* ** observed ** ************ *****, Shayype ***** ******* '*********** security' ** ******* ** using * ********* ****** of ********** ***** *****.

**** '**** ********' ******* that ********* ***** ******* are ****** ******* **** still **** ****** ***** stolen **** ********, ** the ***** ** *** code **** *** ****** nor **** *** ********* the ******* ******. ****** forms ** ************ **** like *****, ** ***** in *** ***** ******* ****: ******* ****:

******* *********** ******** *** security ** **** ** not ***** ***** ********* at ***, ******* ************* a *********** **** **** of ****** **********.

Still ***** ** ******

** *** ********* *** Shayype's *******-***** ****, *** the ****** *** ******* needs ** *********** ** can ** **** **** effectively *** ********, ***** the **** ** ***** record *** **** ********.

Comments (16)

Undisclosed End User #1

07/06/17 03:01pm

I know that a canadian company Cryptocard had something similar to this. I thought it was patented. Now Cryptocard was sold to Safenet, which is now part of Gemalto. I wonder if these people will get sued. :)

 

Avatar

Brian Rhodes

IPVMU Certified | In reply to Undisclosed End User #1 | 07/06/17 04:22pm

That's a good find!

Here is a video of Gemalto's GrIDsure:

The similarities here are strong.  I'll ask Shayype to comment on where/why/if their system is different.

Avatar

Brian Rhodes

IPVMU Certified | In reply to Undisclosed End User #1 | 07/07/17 05:58pm

I emailed Jonathan Craymer, one of the developers of Shayype, to ask about the similiarities between it and Gemalto's GrIDsure.  His response:

"I was the originator of Gridsure (Wikipedia https://en.wikipedia.org/wiki/GrIDsure ) with Stephen Howes, who I hired in as a jobbing technician to do some programming.

However Shayype is a far more developed version, offering scalability for millions of users and the addition of a high security version.

You’ll also notice from the Wiki text that a mathematician Mike Bond criticised Gridsure because in theory a hacker who records the grid display and the characters typed in say 2-3 times could perhaps work out the user’s pattern.

For this reason we’ve created a high security version (Shayype HSS) which doesn’t use the device’s keyboard, preventing a hacker knowing which characters have been typed in. This means in our view that an attacker would have to record/film the login operation several thousand times – which of course they’re unlikely to do."

Essentially, Craymer says that Shayype's separate keypad/ not matrix screen touchpad and obscured displayed inputs (*, not a number) make observation more difficult than the Gemalto version.

 

Undisclosed #2

In reply to Brian Rhodes | 07/07/17 06:14pm

For this reason we’ve created a high security version (Shayype HSS) which doesn’t use the device’s keyboard, preventing a hacker knowing which characters have been typed in. 

Since the public information regarding Shayype HSS  is apparently limited to this one line,

its hard to evaluate it.

However, in regards to the viability of an access control application;

if it indeed forgoes the embedded device input for one using a mobile device, I would wonder what the point is anyway, since many other less cumbersome options exist already, if a smartphone is required.

Undisclosed #2

07/07/17 05:01am

While more difficult to explain than PINs, Shayype patterns can still be explained or sketched out and given to unauthorized users.

1 6 31 36 15 22 may not need much explaining :)

Undisclosed #3

07/07/17 05:34am

This makes it more challenging for a casual shoulder surfer to catch your pin, but a determined person might catch video of the session, and the users pattern can then be determined as long as the session pattern and the entered pin are captured.

Maybe it's unlikely to be able to get this on video thanks to a polorized filter limiting the angle of view and a well-obscured key pad in which case I guess it's pretty good at preventing stolen credentials.

But it's only marginally more difficult to share the pattern with a friend as a pin. Their demonstration video shows just how to do it. A quick scribble on a sticky note and the credentials are shared.

And any modern ACS should support resetting the password via an email link. Every WordPress blog out there does it, and it's free, so that doesn't really excite me. It should be standard.

If you want to prevent sharing of access control credentials, use dual factor authentication, anti pass back, and strong company policy against sharing.

The multifactor authentication itself will strongly limit the possibility of stolen access credentials, and scheduled access along with anti pass back will pretty much limit unauthorized access to the folks who are going to get in no matter what electronic measures are in place.

Afaik, all of this is already available on the market so as innovative as shayypes system appears to be, imo it is not adding significantly more security than what is already available in the market.

Just me?

Undisclosed #2

In reply to Undisclosed #3 | 07/07/17 06:54am

but a determined person might catch video of the session, and the users pattern can then be determined as long as the session pattern and the entered pin are captured.

No, that would not be enough due to the duplicate digits in the grid.  For instance, Brian's 411022 one-time password yields many thousand compatible patterns, not just his valid one of four corners and two  center, so you would not be able to try them all before lock-up.

On the other hand, if you were able to secretly catch video of several logins by the same person, each with their own key grid, you could eventually determine the pattern, by deduction.

Maybe a quant could work the math correctly, but it would go something like each numeric code might be compatible with 50,000 patterns, ~6^6.  Each attempt would yield another 50,000.   Any patterns not in the patterns from the previous attempts would be discarded, since the correct pattern would have to be present in all keys.

Rinse and repeat till there is only one left.  Maybe you could do it with just a handful of tries, or maybe they do something that would make it  much harder, but one login definitely is not enough.  

Unless you're really lucky :)

 

 

 

 

Undisclosed #3

In reply to Undisclosed #2 | 07/07/17 07:01am

Gah, you're right. My mistake! Still, that is pretty much the only attack this addresses and it seems to me it can be reasonably addressed with existing technology. But if you can add this to the list of available security features, why not I guess.

Paul Shah

07/08/17 12:26am

Can I Phish it by creating a fake image of the box to capture the pattern? It seems that all I need the pattern and it doesn't matter what the ransom numbers are.

The attack just changed from capturing the the random numbers to capturing a static pattern. 

Avatar

Brian Rhodes

IPVMU Certified | In reply to Paul Shah | 07/09/17 02:57am

Each number appears multiple times, so even a phising attempt would require multiple observations to understand a pattern.

I'll ask Shayype for specifics, but a single phising attempt will not likely divulge the pattern.

Paul Shah

In reply to Brian Rhodes | 07/09/17 07:31am

It's phishing the pattern, not the random numbers 

Undisclosed #2

In reply to Paul Shah | 07/09/17 06:33pm

But they don't draw the pattern, they only give you numbers back that correspond to many patterns, only one of which is the one that the user set up.

If you were to make every number on the your displayed grid unique your method would work, but since there are 36 squares normally, only using the digits 0-5, such a grid would clearly be a forgery.

 

Paul Shah

07/09/17 07:50pm

So if I were to present you a fake page that had the image and layout of the the matrix layout with arbitrary numbers, you were to click on the on the fake matrix and then i would be able to know your pattern and order.  

I wouldn't be able to login at that moment, but I accomplished my goal. 

Once I have your pattern and order, I can go to the real site, click on the real squares, grab the real random numbers to login to the real site 

Then there is the MITM attack. 

 

 

Undisclosed #2

In reply to Paul Shah | 07/09/17 08:35pm

So if I were to present you a fake page that had the image and layout of the the matrix layout with arbitrary numbers, you were to click on the on the fake matrix....

There is no clicking on any matrix to log in, look at Brian's video above.

The only time you click on the matrix is when you setup the pattern for the first time, and then there are no numbers.

Conceivably, you could phish them to change their pattern, but that doesn't help you know their previous, still valid pattern.

However, it can be done, you just need several attempted logins with different grids to deduce, as I wrote above.

 

Paul Shah

In reply to Undisclosed #2 | 07/09/17 08:41pm

Yes, That makes sense 

Avatar

Brian Rhodes

IPVMU Certified | In reply to Undisclosed #2 | 07/10/17 01:52am

This is correct, Shayype users do not touch a pattern on the matrix.  They visualize the pattern but never physically divulge it.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on Startup

ASIS GSX 2019 Final Show Report on Sep 12, 2019
IPVM went to Chicago for ASIS GSX 2019, with many exhibitors disappointed about traffic and the exhibitor schedule changing next year. However,...
JCI Sues Wyze on Aug 21, 2019
The mega manufacturer / integrator JCI has sued the fast-growing $20 camera Seattle startup Wyze. Inside this note: Share the court...
Verkada People And Face Analytics Tested on Aug 16, 2019
This week, Verkada released "People Analytics", including face analytics that they describe is a "game-changing feature" that "pushes the...
Mobile Access Control Shootout - Farpointe, HID, Openpath, Nortek, Proxy on Jul 29, 2019
One of the biggest rising trends in access control is using phones as credentials but which offering is best? IPVM has tested five of the...
Giant Tyco Campaigns Against Startup Qumulex on Jul 25, 2019
One is a giant conglomerate that owns the world's largest security integrator. The other has no shipping products. But Tyco is campaigning...
How To Quickly Research An Unknown Company on Jul 23, 2019
There are hundreds of companies in the physical security markets, ranging from a flood of new startups to small companies that may or may not be...
ZeroEyes Gun Detection Startup on Jul 16, 2019
A gun detection video analytics startup, ZeroEyes, is being led by a group of 6 former Navy SEALs, aiming to "save lives" by using AI to assist...
Calipsa - UK AI Startup Profile on Jul 10, 2019
Analytic startups are a major industry trend. One UK company, Calipsa is aiming to use AI to filter out false positive alarms for live video...
2019 Mid-Year Video Surveillance Guide on Jul 01, 2019
IPVM's new 400+ page Mid-Year Industry Guide brings all of these issues and events together in a single resource to read and review. It can be...
Directory of 60 Video Surveillance Startups on Jun 25, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...

Most Recent Industry Reports

Schmode is Back, Aims To Turn Boulder AI Into Giant on Sep 16, 2019
One of the most influential and controversial executives in the past decade is back. Bryan Schmode ascended and drove the hypergrowth of Avigilon...
Manufacturers Unhappy With Weak ASIS GSX 2019 And 2020 Shift on Sep 16, 2019
Manufacturers were generally unhappy with ASIS GSX, both for weak 2019 booth traffic and a scheduling shift for the 2020 show, according to a new...
How Cobalt Robotics May Disrupt Security on Sep 13, 2019
While security robots have largely become a joke over the last few years, one organization, Cobalt Robotics, has raised $50+ million from top US...
Panasonic 4K Camera Tested (WV-S2570L) on Sep 13, 2019
Panasonic has released their latest generation 4K dome, the WV-S2570L, claiming "Extreme image quality allows evidence to be captured even under...
ASIS GSX 2019 Final Show Report on Sep 12, 2019
IPVM went to Chicago for ASIS GSX 2019, with many exhibitors disappointed about traffic and the exhibitor schedule changing next year. However,...
Installation Course - Last Chance - Register Now on Sep 12, 2019
Last Chance - Register Now - September 2019 Video Surveillance Install Course. Thursday, September 12th is your last chance to register for the...
Commend ID5 Intercom Tested on Sep 12, 2019
Commend touts the new ID5 intercom as 'timelessly elegant' and the slim body, glass front touchscreen indeed looks better than common, but ugly,...
US State Department: "Chinese Tech Giants" "Tools of the Chinese Communist Party" on Sep 12, 2019
The US State Department has called out "Chinese tech giants" for being "tools of the Chinese Communist Party" in a blunt new speech that makes...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
Yi Home Camera 3 AI Analytics Tested on Sep 10, 2019
Yi Technology is claiming "new AI features" in its $50 Home Camera 3 "eliminates 'false positives' caused by flying insects, small pets, or light...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact