Sensor-based implicit authentication through learning user physiological and behavioral characteristics

BlindLoginV2 and AudioBlindLogin were designed as memorable and usable graphical authentication systems for the blind and visually impaired, to reduce their difficulties in authentication as compared to alphanumeric or biometric authentication. The main aim of this paper is to compare the use of these two alternative graphical authentication systems with the traditional textual-based authentication, and to encourage the blind and visually impaired to use smartphone authentication, by overcoming the difficulties of maneuvering the virtual keyboard. It compares BlindLoginV2 and AudioBlindLogin with the 4-character common traditional textual authentication system, in terms of password creation time, mean login time performance and failure rate, and identifies the factors influencing the mean login time performance of BlindLoginV2 (object picture superiority effect) and AudioBlindLogin (auditory picture superiority effect) for the blind and visually impaired. Quantitative testing results show that both proposed systems are more accessible for the visually impaired as compared with the traditional text-based authentication system because the password creation time and mean login time is significantly shorter with lower failure rates. Results also show that the type of authentication method, the visual capability and the age of the user, and the interactions between these three factors significantly influences the mean login time performance.

Comparison of BlindLoginV2 and AudioBlindLogin with the common textual password authentication for the blind and visually impaired using smartphones

Virtual Reality (VR) has gained popularity in numerous fields, including gaming, social interactions, shopping, and education. In this paper, we conduct a comprehensive study to assess the trustworthiness of the embedded sensors on VR, which embed various forms of sensitive data that may put users’ privacy at risk. We find that accessing most on-board sensors (e.g., motion, position, and button sensors) on VR SDKs/APIs, such as OpenVR, Oculus Platform, and WebXR, requires no security permission, exposing a huge attack surface for an adversary to steal the user’s privacy. We validate this vulnerability through developing malware programs and malicious websites and specifically explore to what extent it exposes the user’s information in the context of keystroke snooping. To examine its actual threat in practice, the adversary in the considered attack model doesn’t possess any labeled data from the user nor knowledge about the user’s VR settings. Extensive experiments, involving two mainstream VR systems and four keyboards with different typing mechanisms, demonstrate that our proof-of-concept attack can recognize the user’s virtual typing with over 89.7% accuracy. The attack can recover the user’s passwords with up to 84.9% recognition accuracy if three attempts are allowed and achieve an average of 87.1% word recognition rate for paragraph inference. We hope this study will help the community gain awareness of the vulnerability in the sensor management of current VR systems and provide insights to facilitate the future design of more comprehensive and restricted sensor access control mechanisms.

Privacy Leakage via Unrestricted Motion-Position Sensors in the Age of Virtual Reality: A Study of Snooping Typed Input on Virtual Keyboards

In today’s modern world, security is a major concern. To provide security, the most widely recognized authentication methods are credentials, OTP, LTP, etc, and these methods are more prone to brute-force attack, shoulder surfing attack, and dictionary attack. Shoulder surfing attack (SSA) is a data theft approach used to obtain the personal identification numbers or passwords by looking over the user’s shoulder or by external recording devices and video-capturing devices. Since SSA occurs in a benevolent way, it goes unnoticed most of the time. It is one of the simple and easy methods for hackers to steal one’s sensitive information. The hacker has to simply peek in while the user types in the password without any much effort involved. Therefore, this phenomenon is widely unknown to people all over the world. Textual passwords are a ubiquitous part of digital age. Web applications/mobile applications demand a strong password with at least one capital letter and a special letter. People tend to give easy passwords in order to remember them which can be easily shoulder surfed. To overcome this, graphical password techniques are used to provide a more secure password. In the graphical authentication system, the users click on target images from a challenge set for authentication. Various graphical systems have been proposed over the years which are shown to be more secure when compared to other authentication systems. In this paper, an overview of various graphical authentication systems is presented.

R. Ramya

Papers

A Survey on Graphical Authentication System Resisting Shoulder Surfing Attack