# Use of ambiguous letters in security codes **URL:** \ **Category:** The BBQ Pit\ **Created:** [June 24, 2022, 6:01pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773 "2022-06-24T18:01:44Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [June 25, 2022, 3:56pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/21 "2022-06-25T15:56:03Z")
My favorite is to click on the pictures with crosswalk, traffic lights, cars etc. and it is one picture cut into 9 pieces. So is that piece with the corner of the traffic light in it a yes or a no? ---
**Author:** ![carrps](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carrps/32/2957_2.png) [@carrps](https://boards.straightdope.com/u/carrps)\ **Post date:** [June 25, 2022, 5:05pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/22 "2022-06-25T17:05:10Z")
I always treat it as a ‘yes.’ It’s worked so far. ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [June 25, 2022, 5:18pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/23 "2022-06-25T17:18:38Z")
[![](https://img.ifunny.co/images/dfab228d5b20861e8744c7647bfd472008be41a8865e503c9b552fb9431837f1_1.jpg) ](https://img.ifunny.co/images/dfab228d5b20861e8744c7647bfd472008be41a8865e503c9b552fb9431837f1_1.jpg) ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [June 25, 2022, 5:29pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/24 "2022-06-25T17:29:21Z")
> [@Briny\_Deep](#): > > [https://img.ifunny.co/images](https://img.ifunny.co/images) /dfab228d5b20861e8744c7647bfd472008be41a8865e503c9b552fb9431837f1\_1.jpg - The bottom right corner looks like part of a traffic light but does it count? Whoever puts these together is an idiot. ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [June 25, 2022, 5:50pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/25 "2022-06-25T17:50:48Z")
Surely it must be auto-generated in terms of what falls within what square – nothing thought-out in advance – but then the “correct” answer is a popularity contest; you just have to guess what you think others guessed. Hence the anxiety sweat. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [June 25, 2022, 6:53pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/26 "2022-06-25T18:53:44Z")
> [@Briny\_Deep](#): > > Surely it must be auto-generated in terms of what falls within what square – nothing thought-out in advance – but then the “correct” answer is a popularity contest; you just have to guess what you think others guessed. And whoever designed that system is an idiot. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [June 25, 2022, 7:52pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/27 "2022-06-25T19:52:52Z")
> [@Senegoid](#): > > 30-some years ago, I used to generate “temporary” passwords for new users. (“Temporary” only in the sense that I gave them a document with the password and instructions for changing it, and advising them to do so.) I’m a designated timekeeper and do pretty much the same thing for the employees on my list when the password for their virtual timecard stops working. Usually they simply forget what it is but recently one emailed me and the timekeeping help desk so they ended up with two temporary passwords. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [June 26, 2022, 4:38am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/28 "2022-06-26T04:38:38Z")
> [@lobotomyboy63](#): > > In Texas, partly due to my failing vision on the plate and partly because of the font, sometimes K looks like X. Some years ago, California came out with a new license plate font in which you needed a magnifying glass to tell O from Q. That was quickly fixed, and subsequent plates had a huge tail on the Qs. [![](http://www.oldpl8s.com/sell-65-QXS057-a.jpg) ](http://www.oldpl8s.com/sell-65-QXS057-a.jpg) [![](https://www.route66store.ch/images/product_images/popup_images/california-blueplate.jpg) ](https://www.route66store.ch/images/product_images/popup_images/california-blueplate.jpg) ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [June 26, 2022, 3:45pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/29 "2022-06-26T15:45:04Z")
Cloudflare encryption using lava lamps. [//www.cloudflare.com/learning/ssl/lava-lamp-encryption/](https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/) Or am I being whoooosssed? ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [June 26, 2022, 5:32pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/30 "2022-06-26T17:32:51Z")
> [@enipla](#): > > Or am I being whoooosssed? It’s plausible. And “lava lamp encryption” will get attention which is good for a business. I wrote code for a game once that would generate random numbers from a seed derived from a fraction of a second on the clock when the player started the game. Because that will be truly random. Getting real randomness on a computer often relies on borrowing from the analog world, because true digital randomness is hard. ---
**Author:** ![Dancer\_Flight](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dancer_flight/32/7601_2.png) [@Dancer\_Flight](https://boards.straightdope.com/u/Dancer_Flight)\ **Post date:** [June 26, 2022, 5:43pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/31 "2022-06-26T17:43:30Z")
Tom Scott video on the process. [![](https://img.youtube.com/vi/1cUUfMeOijg/maxresdefault.jpg "The Lava Lamps That Help Keep The Internet Secure") ](https://www.youtube.com/watch?v=1cUUfMeOijg) ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [June 26, 2022, 7:00pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/32 "2022-06-26T19:00:17Z")
> [@Atamasama](#): > > Because that will be truly random. Getting real randomness on a computer often relies on borrowing from the analog world, because true digital randomness is hard. Yup. Raindrops might work as an analog input. Lava lamps are cooler though… ---
**Author:** ![wolfpup](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpup/32/10618_2.png) [@wolfpup](https://boards.straightdope.com/u/wolfpup)\ **Post date:** [June 28, 2022, 11:48am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/33 "2022-06-28T11:48:27Z")
> [@thelurkinghorror](#): > > Agreed to 2FA. Especially since it’s nonsensical. My bank doesn’t make me do it, but Workday makes you redo for every device weekly, and the worst damage someone can do is look at my paycheck. Also annoying is GMail that is starting to force people to 1) have smart phones, 2) make it hard for people to share an account as you need to have one person ready to confirm in a 15 minute window. Actually I think 2FA is an effective security augmentation that in many cases is quite necessary, but I agree that incompetent IT types can create bad implementations. I was initially pissed off that Gmail discontinued its simple password-only login capability (the one where you had to check “allow login from less secure devices”) and instead required Oauth or “Google login” authentication, because I (and others I know) cannot easily upgrade our current POP3/IMAP clients to Oauth2. Fortunately, Gmail did it right by also offering a 2FA option as an alternative, along with a device-specific password. The 2FA authentication is only required once, for the first time for each device, and subsequently never again for a device that’s already authenticated. It’s simple, effective, and non-intrusive. ---
**Author:** ![thelurkinghorror](https://avatars.discourse-cdn.com/v4/letter/t/7c8e57/32.png) [@thelurkinghorror](https://boards.straightdope.com/u/thelurkinghorror)\ **Post date:** [June 28, 2022, 7:14pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/34 "2022-06-28T19:14:05Z")
I don’t have any particular issues with 2FA, but the difficulty of login sometimes seems to inversely correlate with how secure something should be. What’s obnoxious about Google is that they seem to have grandfathered in old accounts, but new ones forced it. I’m sure there’s better services for managing shared accounts, but that’s what I’m given. None of these handle VPNs well, not sure if they _should_, but it’s a hassle for sure. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [June 28, 2022, 7:40pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/35 "2022-06-28T19:40:17Z")
> [@Atamasama](#): > > I wrote code for a game once that would generate random numbers from a seed derived from a fraction of a second on the clock when the player started the game. Because that will be truly random. Random enough for a game, sure. Not remotely random enough for cryptography. If the clock ticks over every millisecond, and you can figure out down to a minute when the user started the program, that’s only 60,000 possibilities to check, easy for a brute-force method. Get it down to an hour, and it’s still only 3.6 million. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [June 28, 2022, 7:46pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/36 "2022-06-28T19:46:37Z")
What I have seen is that the operating system constantly “harvests” entropy, or a specific application will even ask you to randomly bang on the keyboard, and the resulting entropy is distilled into random bits. I admit to having used the clock trick myself, though, because in some applications the pseudo-random samples are not required to be truly random. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [June 28, 2022, 8:05pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/37 "2022-06-28T20:05:00Z")
> [@Chronos](#): > > Random enough for a game, sure. Not remotely random enough for cryptography. I think I was writing in QBASIC, or Pascal. I was a kid. 😆 ---
**Author:** ![digs](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/digs/32/14889_2.png) [@digs](https://boards.straightdope.com/u/digs)\ **Post date:** [June 29, 2022, 3:39am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/38 "2022-06-29T03:39:55Z")
> [@running\_coach](#): > > The bottom right corner looks like part of a traffic light but does it count? Whoever puts these together is an idiot. Ummm, gang? Those gotchas are designed by the very robots who are plotting our demise… this is how they’re learning about traffic lights. Next: “ **Select all squares that show places where humans might hide**.” Not sure I should be typing this, even in my home … (Alexa was _way_ too interested in this thread, so I dropped her in a vat of molten steel before replying here…) ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [June 29, 2022, 5:16am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/39 "2022-06-29T05:16:19Z")
> [@digs](#): > > Not sure I should be typing this, even in my home … (Alexa was _way_ too interested in this thread, so I dropped her in a vat of molten steel before replying here…) - You fool! The nanocircuits will be embedded in whatever is made from that steel! You’ve doomed us all! ---
**Author:** ![digs](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/digs/32/14889_2.png) [@digs](https://boards.straightdope.com/u/digs)\ **Post date:** [June 29, 2022, 5:56pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/40 "2022-06-29T17:56:22Z")
Uh, oh… it was a paperclip factory. Those little nanoclips will soon be everywhere… > [@running\_coach](#): > > You’ve doomed us all! Ehh… I’m okay with that. [Previous page](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773.md?page=1) [Next page](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773.md?page=3)