Johnny can obfuscate: beyond mother's maiden name

Abstract

Challenge/response authentication is stronger than password authentication, but has traditionally required a device for computing the challenge. Though human computation is limited, people can compute simple responses to challenges. If the challenge and the corresponding response is obfuscated with decoy information, an authentication scheme might be strong enough for a number of applications. The signs used in major league baseball provide some interesting techniques for obfuscation.