Johnny can obfuscate: beyond mother's maiden name
William Cheswick · 2006
Challenge/response authentication is stronger than password authentication, but has traditionally required a device for computing the challenge. Though human computation is limited, people can compute simple responses to challenges. If the challenge and the corresponding response is obfuscated with decoy information, an authentication scheme might be strong enough for a number of applications. The signs used in major league baseball provide some interesting techniques for obfuscation.