Beginning around 1996, numerous graphical password schemes have been proposed, motivated by improving password usability and security, two key factors in password scheme evaluation. In this paper, we focus on the security aspects of existing graphical password schemes, which not only gives a simple introduction of attack methods but also intends to provide an in-depth analysis with specific schemes. The paper first categorizes existing graphical password schemes into four kinds according to the authentication style and provides a comprehensive introduction and analysis for each scheme, highlighting security aspects. Then we review the known attack methods, categorize them into two kinds, and summarize the security reported in some user studies of those schemes. Finally, some suggestions are given for future research.

A Survey on the Use of Graphical Passwords in Security

User authentication is the process that is exercised millions of times around the globe by using different techniques and methods. The most prominent way of authentication is alphanumerical password forms that have been used for decades. Authorized access is becoming a challenging issue because of the introduction of modern technologies. In addition, traditional alphanumerical passwords have significant security issues, for example, humans forget the combination of keys due to the selection of a difficult key combination. Moreover, when they choose an easy key combination, this helps hackers to crack their passwords easily. Traditional passwords are also vulnerable to several types of attacks, for example, dictionary attack, brute force attack, and malware. To provide an easy and more secure authentication technique, a graphical password has been introduced in this paper for consumer electronic devices, which uses an image or a set of images for authentication. We have categorized the existing graphical password methods into recognition-based, cued-recall-based, pure-recall-based, and hybrid techniques. Due to the limitations of the existing graphical passwords, we have introduced a new technique, named graphical random authentication technique (gRAT), which generates a randomized set of images every time a user tries to authenticate him/herself by maintaining the security and usability at the same time. The gRAT technique is also tested by user-centric evaluation in terms of security, usability, usefulness, and utility, and the experimental results show that the proposed technique is more secure and useful in the real-life authentication applications.

g-RAT | A Novel Graphical Randomized Authentication Technique for Consumer Smart Devices

The proposed scheme aims to enhance the reliability of text based passwords for advanced users by adapting a combination of text and graphical passwords. In this way a more secure way will be provided to users for granting access to an authenticated system. The proposed idea could be highly beneficial for ATM machines where access method is via a dummy password.

Multimedia graphical grid based text password authentication: For advanced users

Swipe passwords are a popular method for authenticating on mobile phones. In public, these passwords may become visible to attackers who engage in shoulder surfing. There is a need for strategies that protect swipe passwords from over-the-shoulder attacks (OSAs). We empirically explored the impact of providing gesture visual feedback on OSA performance during successful and unsuccessful swipe login attempts on mobile phones. We found evidence that entry visual feedback facilitates OSAs. As users are biased towards symmetrical swipe patterns, we investigated their impact on attack performance. We found that symmetrical swipe patterns were less vulnerable than asymmetrical patterns, possibly due to the speed of entry. As users tend toward simple patterns, we investigated the impact that nonadjacent, diagonal knight moves have on OSAs. We found that knight moves significantly decreased OSA performance. We recommend users turn off gesture entry visual feedback and use knight moves for greater password security.

Swipe Authentication: Exploring Over-the-Shoulder Attack Performance

Nowadays, user authentication is an important topic in the field of information security. To enforce security of information, passwords were introduced. Text based password is a popular authentication method used from ancient times. However text based passwords are prone to various attacks such as dictionary attacks, guessing attacks, brute force attacks, social engineering attacks etc. Numerous graphical password schemes have been proposed so far as it improves password usability and security. In this paper, we conduct a comprehensive survey of the existing graphical password techniques. We can categorize these techniques into four: recognition-based, pure recall-based, cued-recall based and hybrid approaches. Here we analyze the strengths and drawbacks of each method. This survey will be particularly useful for researchers who are interested in developing new graphical password algorithms as well as industry practitioners who are interested in deploying graphical password techniques.

/pdf/a-survey-on-different-graphical-passwordauthentication-2xp8d9n0jj.pdf

A Survey on Different Graphical PasswordAuthentication Techniques

Graphical passwords have been proposed as an alternative to alphanumeric passwords with their advantages in usability and security. However, most of these alternate schemes have their own disadvantages. For example, cued-recall graphical password schemes are vulnerable to shoulder-surfing and cannot prevent intersection analysis attack. A novel cued-recall graphical password scheme CBFG (Click Buttons according to Figures in Grids) is proposed in this paper. Inheriting the way of setting password in traditional cued-recall scheme, this scheme is also added the ideology of image identification. CBFG helps users tend to set their passwords more complex. Simultaneously, it has the capability against shoulder surfing attack and intersection analysis attack. Experiments illustrate that CBFG has better performance in usability, especially in security.

Jinhua Qiu

Papers

A Novel Cued-recall Graphical Password Scheme