1) Tell me who you are, so I can load up your secret 30 character "password" from some database (the fact that this needs to be stored in a retrievable way makes this entire system insecure)
2) Here's one random sequence of 30 characters. Look at it for a little bit, ok now try to reproduce it from memory.
3) Repeat several times (not stated how many).
4) One of those attempts was your specific password, let me check to see if you did significantly better at it than the other (random) ones.
==========================
EDIT: Upon re-read, it sounds like 2-4 are a bit different:
2) Play a long sequence of characters "Guitar-Hero" style. The computer will "slip-in" the true password and watch to see if you do better on that section.
Still storing the password in the clear and still susceptible to being watched several times and finding the "common" sequence.
There's also the fact that your password will ALWAYS be shown as one of the sequences. Would-be hacker just tries 5 times and notes that THIS sequence keeps showing up, that must be the right one.
Maybe there's a more obtuse use-case but this seems like more of a cool experiment on human memory than a practical cryptography tool.
The paper is cheap and assumes they have a human attacker." Threat model: The proposed system is designed to be
used as a local password mechanism requiring physical
presence. That is, we consider authentication at the entrance to a secure location where a guard can ensure that
a real person is taking the test without the aid of any electronics."
I think this system is designed more for something like authenticating people for entry into a secure area, rather than for logging in to a computer. If it is more difficult to obtain access to the password storage than to your user's mind, then this is a useful system.
1) Tell me who you are, so I can load up your secret 30 character "password" from some database (the fact that this needs to be stored in a retrievable way makes this entire system insecure)
2) Here's one random sequence of 30 characters. Look at it for a little bit, ok now try to reproduce it from memory.
3) Repeat several times (not stated how many).
4) One of those attempts was your specific password, let me check to see if you did significantly better at it than the other (random) ones.
==========================
EDIT: Upon re-read, it sounds like 2-4 are a bit different:
2) Play a long sequence of characters "Guitar-Hero" style. The computer will "slip-in" the true password and watch to see if you do better on that section.
Still storing the password in the clear and still susceptible to being watched several times and finding the "common" sequence.