A Password So Secret, You Don’t Consciously Know It

Some efforts to replace traditional letter-and-number passwords rely on gestures, wearable devices, or biometrics. An approach in the works from research-and-development company SRI International and Stanford and Northwestern takes a different tack: passwords that you know but don’t know you know.

Patrick Lincoln, director of SRI’s computer science laboratory and a researcher on the project, calls this “rubber-hose resistant authentication” in reference to rubber-hose cryptanalysis, in which a user is coerced or physically forced to give up, say, the passcode to a secure building. Lincoln says the approach relies on implicit learning—the sort of learning that occurs through sheer repetition, such as learning to ride a bike, that the learner can’t verbally explain—to prevent passwords from being compromised.