All writeups

Building Mosaic-X: passwords made of pixels

Text passwords are the weakest link in almost every system I've taken apart. Mosaic-X is my attempt at replacing them with something that can't be shoulder-surfed, phished, or guessed from a wordlist.

Draft. This post is scaffolded and needs the real implementation details filled in. Remove this callout when it's ready.

The problem with what we have

A password is a secret a human has to remember, which means it is short, structured, and reused. Every property that makes it memorable also makes it weak. We've spent two decades patching around that — complexity rules, rotation policies, second factors — without fixing the underlying issue: the secret is small enough to fit in someone's head.

Images don't have that constraint. A photograph carries far more entropy than any passphrase a person will actually type, and a person can recognise the right image instantly without having to recall a single character of it.

The idea

Mosaic-X derives key material from the pixel data of an image you choose, then binds that material to a fingerprint of the machine it's running on. Neither half is sufficient alone: the image without the hardware is inert, and the hardware without the image reveals nothing.

Extracting entropy from pixels

TODO — describe the extraction step: which channels you sample, how you handle the fact that lossy re-encoding changes pixel values, and how much entropy you actually measured coming out of a typical image.

Binding to hardware

TODO — describe the fingerprint: which identifiers you combine, how you handle a component being replaced, and what the recovery story is when the binding no longer matches.

Deriving the key

TODO — describe the KDF: which function, what parameters, and why you chose those cost settings.

What I'd do differently

TODO. This is usually the most-read section of any writeup — the honest account of what didn't work is what makes the rest credible. Worth writing properly.

Try it

Mosaic-X v1.0.0 is available on GitHub. If you break it, I'd genuinely like to hear how — get in touch.