 A users' shared secret is a set of 3–5 categories out of a possible 12, which is only 8–10 bits of entropy.Vidoop allows users to enter in their categories in at least two possible orders, reducing the effective secret by a bit.An attacker in possession of the pre-authorization cookie could guess 1-2% of passwords in the three given trials.