Starting around 1999, a great many graphical password schemes have been proposed as alternatives to text-based password authentication. We provide a comprehensive overview of published research in the area, covering both usability and security aspects as well as system evaluation. The article first catalogues existing approaches, highlighting novel features of selected schemes and identifying key usability or security advantages. We then review usability requirements for knowledge-based authentication as they apply to graphical passwords, identify security threats that such systems must address and review known attacks, discuss methodological issues related to empirical evaluation, and identify areas for further research and improved methodology.

/pdf/graphical-passwords-learning-from-the-first-twelve-years-1h8jsqlrwr.pdf

Graphical passwords: Learning from the first twelve years

Lately, electroencephalography (EEG)-based auth- entication has received considerable attention from the scientific community. However, the limited usability of wet EEG electrodes as well as low accuracy for large numbers of users have so far prevented this new technology to become commonplace. In this study a novel EEG-based authentication system is presented, which is based on the rapid serial visual presentation paradigm and uses a knowledge-based approach for authentication. Twenty-nine subjects’ data were recorded and analyzed with wet EEG electrodes as well as dry ones. A true acceptance rate of 100% can be reached for all subjects with an average required login time of 13.5 s for wet and 27 s for dry electrodes. Average false acceptance rates for the dry electrode setup were estimated to be $3.33 \times 10^{-5}$ .

A High-Security EEG-Based Login System with RSVP Stimuli and Dry Electrodes

In this paper, we present XSide, an authentication mechanism that uses the front and the back of smartphones to enter stroke-based passwords. Users can switch sides during input to minimize the risk of shoulder surfing. We performed a user study (n = 32) to explore how switching sides during authentication affects usability and security of the system. The results indicate that switching the sides increases security while authentication speed stays relatively fast (≤ 4 seconds). The paper furthermore provides insights on accuracy of eyes-free input (as used in XSide) and shows how 3D printed prototype cases can improve the back-of-device interaction experience.

Now you see me, now you don't: protecting smartphone authentication from shoulder surfers

The graphical password authentication scheme uses icons instead of text-based passwords to authenticate users. Icons might be somehow more familiar to human beings than text-based passwords, since it is hard to remember the latter with sufficient security strength. No matter what kind of password is used, there are always shoulder-surfing problems. An attacker can easily get text-based password or graphical password by observation, capturing a video or recording the login process. In this paper, we propose a shoulder-surfing-proof graphical password authentication scheme using the convex-hull graphical algorithm. We give evaluation and comparisons to demonstrate the security strength and the functionality advantages of our scheme.

Shoulder-surfing-proof graphical password authentication scheme

Nowadays, user authentication is one of the important topics in information security. Strong textbased password schemes could provide with certain degree of security. However, the fact that strong passwords are difficult to memorize often leads their owners to write them down on papers or even save them in a computer file. Graphical authentication has been proposed as a possible alternative solution to textbased authentication, motivated particularly by the fact that humans can remember images better than text. In recent years, many networks, computer systems and Internet based environments try used graphical authentication technique for their users authentication. All of graphical passwords have two different aspects which are usability and security. Unfortunately none of these algorithms were being able to cover both of these aspects at the same time. In this paper, we described eight recognition based authentication algorithms in terms of their drawbacks and attacks. In the next section, the usability standards from ISO and the related attributes for graphical user authentication usability are discussed. The related attack patterns for graphical user authentication security part are also discussed. Finally, a comparison table of all recognition based algorithms is presented based on ISO and attack patterns standards.

A Survey on Recognition Based Graphical User Authentication Algorithms

Text-based passwords are ubiquitous authentication system. This traditional authentication system is well- known for its flaws in the aspects of usability and security issues that bring problems to users. Hence, there is a need for alternative mechanism to overcome these problems. Graphical passwords, which consist of clicking or dragging activities on the pictures rather than typing textual characters, might be the option to overcome the problems that arise from the text-based passwords system. In this paper, a comprehensive study of the existing graphical password schemes is performed. We compared and categorized these schemes into two groups; recognition-based scheme and recall-based scheme. We also list out several usability and security features for research continuity in this area.

/pdf/towards-identifying-usability-and-security-features-of-4j0dp0xgg4.pdf

M.D. Hafiz

Papers

Towards Identifying Usability and Security Features of Graphical Password in Knowledge Based Authentication Technique