With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running.

How about password knocking? For example you have three passwords: A, B and C. None of them is correct by itself, but entered one-by-one in this order they will grant you access.

Some scenarios to make this idea clearer:

Scenario 1.


You: Password A.

Server: Invalid password.

You: Password B.

Server: Invalid password.

You: Password C.

Server: Password accepted.



Scenario 2.


You: Password A.

Server: Invalid password.

You: Password C.

Server: Invalid password.

You: Password B.

Server: Invalid password.



Scenario 3.


You: Password A.

Server: Invalid password.

You: Password B.

Server: Invalid password.

You: Password B.

Server: Invalid password.

You: Password C.

Server: Invalid password.



Scenario 4.


You: Password A.

Server: Invalid password.

You: Password A.

Server: Invalid password.

You: Password B.

Server: Invalid password.

You: Password C.

Server: Password accepted.



I can't think of any drawbacks of this method over regular single password login. Moreover, it makes dictionary attacks exponentially harder with each added password.

I realize it's security by obscurity and doesn't abolish the need for strong passwords. Password sequence itself is as strong as a concatenation of passwords used. Added security in this method comes from unexpectedly complex procedure.

Is it a good idea? Is it a better idea than classic password?

The system outlined in the question is actually weaker than simply requiring a single password of length A+B+C, because it permits a class of attacks that can't be used against single passwords:

Say your three-password combination is E F G.  An attacker can send the passwords A B C D E F G, making five attacks (A B C, B C D, C D E, D E F, and E F G) for the price of two.  The general term for this is a de Bruijn sequence, and it lets you attack any state-based system (such as a digital lock) using far fewer tries than there are possible combinations.
