Design memo: why students sign in with picture sequences

Design memos document real decisions in Wiz Kids and the research behind them.

A Wiz Kids student signs in by finding their class, tapping their animal name, and then tapping three pictures in order — their secret. No typed password exists for students, anywhere in the product. This memo explains a choice that surprises adults ("isn't that less secure?") and why we'd make it again.

The developmental argument

A text password assumes the very skills our earliest users are here to learn: fluent typing, stable spelling, safe text entry. Demanding one before those exist produces the predictable classroom reality — passwords chosen for typeability (dog123), written on cards, typed slowly in full view, and forgotten weekly. Recognition, by contrast, is developmentally cheap: young children's recognition memory for pictures is excellent and famously durable (the picture-superiority literature; children reliably recognize images they cannot spell or name precisely). A three-picture sequence sits inside working-memory limits, requires no literacy, and is entered in three taps — fast enough that signing out and back in stays cheap, which keeps the sign-out habit affordable. Graphical authentication isn't our invention; the research field (Passfaces, recognition-based schemes reviewed by Biddle, Chiasson & van Oorschot, 2012) established both its memorability advantages and its known weaknesses — which we'll get to, because they shaped the design.

The security argument (sized to the threat)

Security design starts with the actual adversary. For a primary student's seat, that adversary is a classmate at the same machine — not a botnet. The known weaknesses of graphical secrets (smaller theoretical space than long text; shoulder-surfing) are real and the right trade here:

• The realistic attack, guessing, is rate-limited server-side (a handful of failures triggers cooldown) — the arithmetic of sequence-from-a-grid against a throttle is plenty for what's protected.
• Shoulder-surfing is a genuine cost — taps are watchable. We treat it as curriculum: the safety realm teaches shielding your secret like shielding a hand of cards, and the recovery path (teacher resets the seat in one click, no secret ever revealed) makes any compromise a two-minute inconvenience. Which points at the deeper principle —
• What the secret protects is deliberately small. A seat's contents are pseudonymous game progress (zero-PII); the breach-cost question for a single compromised seat answers "someone's stars." We sized the lock to the vault and the user — the error most children's products make is demanding adult-grade credentials to protect data they shouldn't be holding anyway.

The habit argument (the real payoff)

The picture secret is a training credential: every social rule that matters for real passwords is fully expressible on it, years before a child can manage correct-horse-battery-staple. Ours is the account on which children first practice: secrets are never shared (the best-friend scenario is literally our first safety lesson), never shown, never asked-for by any legitimate message; adults reset rather than know (the toothbrush rules); one wizard, one login (sessions). By the time text passwords arrive in their lives, the social layer — where child accounts actually fail — is reflex, and only the mechanics (passphrases, one-per-door) remain to teach.

The privacy corner it completes

A student credential that involved anything about the child — a chosen word, a memorable date, a photo — would be a personal-data leak into an architecture built on having none. Generated animal name + picture sequence completes the loop: nothing in a student's authentication encodes anything about them (the hashed-emails page explains why derived-from-the-person is the property to avoid). Teachers, who can manage them, get real passwords plus printed one-time recovery codes — each cohort gets the strongest mechanism it can actually operate.

References

• Biddle, R., Chiasson, S., & van Oorschot, P. C. (2012). Graphical passwords: Learning from the first twelve years. ACM Computing Surveys, 44(4) — the field review: memorability strengths, shoulder-surfing and hotspot weaknesses.
• Standing, L. (1973). Learning 10,000 pictures. Quarterly Journal of Experimental Psychology, 25 — the classic picture-recognition capacity result behind picture superiority.
• NIST SP 800-63B — rate-limiting and throttling as the counter to online guessing (the mechanism doing the heavy lifting here).

© Glu IO Pty. Ltd. — Wiz Kids (wiz.kids). Link freely; republication requires permission — see terms. Found an error in our reading of the research? We correct fast: tell any teacher piloting Wiz Kids.