Icon passwords for preschoolers
Hi! My name is Tulika, I am a co-founder at Tassu Passu. In 2019 we were formed during a hackathon (Junction 2019) where we were looking for ways to empower kids to increase their cybersecurity. Our solution is a password for kids using pictures which combine to form a story of their own unique hero. The goal is to be able to login to websites without being able to read or write. You can test our demo solution by logging to tassupassu.using your phone.
Our aim with this project is to help kids and we would like to feedback from you parents and your kid to see if we are succeeding in our goal! My question for you as parents is: Is this something that you see a need for? What other functionality would you like us to add in? Is it easy for your child to remember their characters?
We have also made a survey that you can fill in after testing the demo with your child: https://tulika479048.typeform.com/to/Byy23r
can't wait... :)
Appreciate the support :)
of course. keep going!
@zakke so glad to hear your feedback! :) ps we can let you know once the beta version is out ;)
I freakin' love this idea. I don't have kids of my own, but could I have this for my own authentication? 😬
Is this meant for low security applications?
It appears to be a 5 character pin with an alphabet size of 6 which means it only has 7,776 possible combinations. A 4-number pin, for comparison, has 10,000 possible combinations. Since each character comes with a prompt, I imagine there will be a lot of clustering around certain objects (e.g. a burger for "your hero eats" might be used in 60% of passwords).
Hey @sirotkin! Thank you have having a look and taking time to provide feedback. You have some great points.
This is a demo that we had built for the hackathon (in 48 hours) hence we had a very limited number of options. Our final solution would have ca 100 characters out of which 8 would be randomly presented (in a random order) for each question And we would also increase the number of questions ('alphabet size').
It is also true that there is a risk of certain objects being 'more popular'. In our in-person testing, the answers were surprisingly not clustered towards certain objects (I thought that dragon would be one of those 'popular' objects, but it surprisingly wasn't. Same with burgers. But of course, we have to be vary of that and so we are devising equally attractive options. Also in the final version, not everyone would get the same choice of icons to choose from (see above) - so not everyone would get to choose a burger.
Thanks again for having a look :)
Selecting 8 out of 100 characters for each question would less secure. If you always show the same 8 characters, then it does not actually increase the alphabet size. If you show 8 random characters then you are actually exposing the password because the character the child selected will remain constant (i.e. only 7 characters will be random).
Hey @sirotkin, good points and very true. That is something that we are currently working on and trying to find alternate solutions. Do you have any suggestions?
Hi,
Seems like a nice but ultimately worrisome idea to me:
Hi @rab
thank you for having a look and taking time to post questions.
Why it is needed:
Based on our research 7/10 kids under the age of 5 use tablet devices. They use it to access different websites and services. Often they have their own accounts.
An example from personal life is when kids have an account for a game. It can be intensely frustrating for the child to be locked out of the game - maybe accidentally "logged out" and then they don't remember the password. All the hours of hard work and progress in certain levels is wiped out.
So right now we are concentrating on simple password needs such as authentication for games and educational websties.
Security:
If we simply test having 10 questions with 10 options randomly selected from 100 possible options, it would already be quite secure.
In our team, Ronalds and Reinis who manage our back-end and front-end respectively have more cybersecurity experience and can further answer your questions.
Hi @tulika19,
Thanks for your reply.
Sounds a nightmare.
10 * 10 * 100 is not secure but maybe you mean something different.
There is certainly room to do something in this space but imo I think you should rethink it.
I can read. I can write. I can remember passwords.
Why not give me an app so I can sign my kid in ?
Hi @rab,
Thanks again for taking the time to respond and give your feedback!
it would be 10^10 + adding an extra layer by adding a potential randomizing feature for the 100.. we are still working on it.
Your final part regarding giving the app for kid is good feedback.
Our intial assumption was that helping kids sign in everytime they forget their password might be a pain point.. and thus empowering the child to manage that themselves would be a good solution + empowering for the child.
How do you think regarding that? In case you are a parent, do you experience that as a pain point?
Hi. Parent yes. My experience is login sessions are persistent so forgotten password problems are infrequent and recoverable through parents email. Young kid having a password that I don't know is not attractive to me.
Ah okay that's really good feedback! To hear that kids being logged out is not such a severe problem.
Regarding the solution, I now realize I should explain better. Our idea was like this. There would be two versions of Tassu Passu: One for the parent. One for the child.
Currently, the vast web can be a dangerous place for a child, so this is a more protected start to access different websites. Sort of like starting at the shallow end of the pool. Over time as the child grows older, maybe there can be a conversation regarding which websites to add.
So actually yes, it would be an app through which the parents sign in and yes, the parents would know the password too.
Thank you for getting back so many times, writing about the app is a lot different than speaking about it in person, and I have learnt a lot regarding how to present the message.
Considering the current explanation, the only difference would be reducing the pain of resetting the password through the email... Does this offer a better explanation? Is resetting passwords an actual pain point?
It is also valuable to get your feedback as a parent since it's been a challenge to find parents to discuss this with because of Covid and forums having rules about no-marketing... as a parent do you think asking about this would be considered marketing?
Interesting. I'll send you an email when i get chance.
Sure! It's: tulika@tassupassu.com
Looking forward to your feedback
i'm wary of this thinking in the software space:
If a company builds chain locks for securing your apartment door, do we ask them these questions? Probably, not. Just because one company builds deadbolts for the door, another electronic locks, and another chain locks, does not mean any is better or worse than another.
Rather, it means, they serve different purposes - at different levels of security and security redundancy.
We should be thinking about digital security in the same way.
Analogy is limited as commercial locks pass standards. What purpose does a password serve a preschooler beyond a false sense of security for the parent?
fun idea. i like the idea, a lot.
i myself think there is a lot of room for innovation in the authentication and authorization space. i think it is quite badly designed historically - passwords particularly are the worst.
your idea reminds me of a company called https://clever.com/. you might find taking a look at their business model as useful to your longer term plans for authentication via pictures.
Hello @gatleon,
thank you for having a look and posting feedback!
I agree with you and it is good to have alternative solutions for login that don't require biometrics.
Wow! That's a really cool company with an awesome solution. You are right, we can learn quite a bit from them! Thank you!