Building Mosaic-X: passwords made of pixels
Text passwords are the weakest link in almost every system I've taken apart. Mosaic-X is my attempt at replacing them with something that can't be shoulder-surfed, phished, or guessed from a wordlist.
Draft. This post is scaffolded and needs the real implementation details filled in. Remove this callout when it's ready.
The problem with what we have
A password is a secret a human has to remember, which means it is short, structured, and reused. Every property that makes it memorable also makes it weak. We've spent two decades patching around that — complexity rules, rotation policies, second factors — without fixing the underlying issue: the secret is small enough to fit in someone's head.
Images don't have that constraint. A photograph carries far more entropy than any passphrase a person will actually type, and a person can recognise the right image instantly without having to recall a single character of it.
The idea
Mosaic-X derives key material from the pixel data of an image you choose, then binds that material to a fingerprint of the machine it's running on. Neither half is sufficient alone: the image without the hardware is inert, and the hardware without the image reveals nothing.
Extracting entropy from pixels
TODO — describe the extraction step: which channels you sample, how you handle the fact that lossy re-encoding changes pixel values, and how much entropy you actually measured coming out of a typical image.
Binding to hardware
TODO — describe the fingerprint: which identifiers you combine, how you handle a component being replaced, and what the recovery story is when the binding no longer matches.
Deriving the key
TODO — describe the KDF: which function, what parameters, and why you chose those cost settings.
What I'd do differently
TODO. This is usually the most-read section of any writeup — the honest account of what didn't work is what makes the rest credible. Worth writing properly.
Try it
Mosaic-X v1.0.0 is available on GitHub. If you break it, I'd genuinely like to hear how — get in touch.