Can I change my phassword/-phrase('s settings) in a way that it's important which key of multpile ones (e. g. the left shift key instead of the right one) is chosen?

Could I go a step further and ask for a specific order of keystrokes and their combinations even if the result isn't visible if typed the passphrase in a(ny) text program (e. g. deleting text during input)?


DopeGhoti's answer (No!) is the correct one, as long as we're talking standard software, which means reading the passphrase as a single line of text which you can type any way you want (and even correct typos), until you hit Enter.

That said, it's technically possible to distinguish Left/Right shift keys, as xev easily demonstrates. So as long as the keyboard itself sends different keycodes depending on which key was pressed, you could work with it - if you go to the trouble of creating your own wrapper that reads individual keystrokes instead of text.

Going further, you could even add things like having to enter the passphrase in a specific rhythm, or whatever. Kind of like cheatcodes some old games used to have. You could even use a real game controller to input those...

So (Yes!) almost anything is possible, but you'd have to develop a program that provides such functionality, and make it turn your desired input into a textual representation or hash, which can then be used as the passphrase. And the problem then is to make it such that the user has a realistic chance of re-producing the same representation/hash repeatedly.

So if you do decide to turn your passphrase input into a rhythm game, it should allow some generous leeway. With a regular keyboard pressing shift twice (without typing a letter) is no harm done, how would your software deal with such misinputs?

In any case, with effort, it's possible. The bigger question then, is whether there is any point in doing this. Distinguishing left/right shift key only adds 1 bit of entropy anyway. It doesn't seem very useful.

Passphrase wrappers in general are not unheard of, it's done to support dedicated hardware for example (like integrating a yubikey challenge response). 2-factor authentication, high entropy passphrase, may be worth it.

| improve this answer | |

No. Both Shift keys (presuming that your keyboard has two Shift keys, which is in no ways guaranteed) perform precisely the same operation when inputting text via keyboard input (notwithstanding extravagant ideas like remapping RShift to Compose or somesuch, but then it's not a Shift key any longer). An a is distinct from an A, but there is no way to distinguish an A created by RShift-A from one sent to input by LShift-A, or indeed from one sent by pasting from the clipboard, or entering a Unicode or ASCII code on the Numeric Keypad whilst holding Alt (in some configurations), or any of myriad possible means of sending text input. Once the A has been input, an A is an A is an A.

| improve this answer | |
  • Some packages (or websites sometimes) take the numbers from a number block differently than from the "number line" between the <kbd>F1</kbd> to <kbd>F12</kbd> row or the <kbd>PageUp</kbd>/<kbd>PageDown</kbd>/<kbd>Pos1</kbd>/<kbd>End</kbd> and the arrow keys from number block and from their counterpart keys. There's also <kbd>Return</kbd> and <kbd>Enter</kbd>(, which somehow could also make a difference, for their stroke signals that the phrase is to pass then)... Considering all keys, there are also <kbd>Ctrl</kbd>, the calc signs (+-*/,) and - as far as I know - mostly the MS Win keys. – Nepumuk Jan 24 '19 at 21:42
  • Shift was only one example... – Nepumuk Jan 24 '19 at 21:44
  • The point is that one a character is input, there is no way to distinguish by what means it had been input. There is no way to distinguish a * that had been entered with Shift+8 from one entered with the numeric keypad. – DopeGhoti Jan 24 '19 at 21:54
  • E. g. VirtualBox's default host key is the right Ctrl key. The left one doesn't manage to exit the vm... – Nepumuk Feb 6 '19 at 20:54
  • 1
    Reading hardware scancodes is different from comparing data which have been input. There is no "Ctrl" character, much less a "LCtrl" or "RCtrl" character to compare. – DopeGhoti Feb 6 '19 at 21:58

Not for passphrase, as it is just a sequence of bytes.

As for password, then if you re-write the password authentication system (or just add a module). However you may break some stuff (e.g. sudo, and other stuff that nether you or I consider). The computer can read key-codes, and measure timing, but the standard password system, only stores a test-string. It could be adapted, but see the next paragraph.

You are considering violating the first rule of security: “A security device must be hard for an attacker, and easy for a legitimate user.” This seem to make it hard for a legitimate user, and add very little difficulty for an attacker.

Having said that, it could be a good exerciser, even if practically, it reduces security. A friend once wrote a login system that just measured how quickly he could press space (years later, I realised that this was a bio-metric system).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.