Vidoop
| Company type | Private |
|---|---|
| Industry | Software, Computer security |
| Founded | 1 January 2006 in Tulsa, Oklahoma, United States |
| Defunct | May 30, 2009 |
| Headquarters | Portland, Oregon , United States |
| Products | Vidoop Secure, myVidoop.com |
Number of employees | 4 |
Vidoop LLC operated as a privately owned enterprise headquartered in Portland, Oregon. Its primary offering, Vidoop Secure, was an authentication system engineered to function without conventional passwords, asserting protection against brute force, keystroke logging, phishing, and certain man-in-the-middle attack methods. On 30 May 2009, the company declared it would cease operations.
Founding and Launch
Established in 2006 in Tulsa, Oklahoma with an initial team of four employees, Vidoop created an innovative authentication approach that conceals access credentials in plain view. Following more than a year of development, the firm introduced Vidoop Secure at the Web 2.0 Expo held in San Francisco, California on 17 April 2007. During the event, co-founder Luke Sontag showcased the technology and revealed that a Fortune 500 corporation planned to implement Vidoop’s login system by July 2007.
Products
The centerpiece of Vidoop’s technology was the Vidoop Dynamic Image Grid, which underpinned both Vidoop Secure and myVidoop.com. Revenue was generated through selling advertising placements within the grid, featuring global brands such as Smart USA (Daimler) and ConocoPhillips (including Phillips66, Conoco, and 76 gas stations), along with regional and local advertisers like Mazzio's and Jackie Cooper Imports based in Tulsa.
Vidoop Secure
Vidoop Secure is an authentication mechanism that utilizes classified images. During registration, users pick image categories (for example, airplanes, cars, or keys). The user’s device receives an "activation" cookie only after verifying a code sent via email or phone call (voice or text message). Upon login, if the cookie is detected, a grid displaying images from the selected categories appears. The user then inputs the randomized letter associated with each image to generate their access code.
myVidoop.com
myVidoop.com functioned as an OpenID provider managed by Vidoop and powered by the Vidoop Secure system. It supported decentralized single sign-on for websites, consistent with the OpenID initiative.
Criticisms
Vidoop encountered skepticism concerning its assertions of resistance to hacking attempts. Security experts at CommerceNet demonstrated a potential vulnerability and released a video illustrating a man-in-the-middle exploit targeting myVidoop.com.
Questions were also raised about the usability of Vidoop Secure for individuals with visual disabilities.
The authentication framework depends on a short secret combined with a "pre-authorization" cookie. Users select between three to five categories out of twelve options, yielding only 8–10 bits of entropy. Permitting category input in various sequences further diminishes security. An attacker possessing the pre-authorization cookie could potentially guess approximately 1–2% of passwords within three attempts.