Starting around 1999, a great many graphical password schemes have been proposed as alternatives to text-based password authentication. We provide a comprehensive overview of published research in the area, covering both usability and security aspects as well as system evaluation. The article first catalogues existing approaches, highlighting novel features of selected schemes and identifying key usability or security advantages. We then review usability requirements for knowledge-based authentication as they apply to graphical passwords, identify security threats that such systems must address and review known attacks, discuss methodological issues related to empirical evaluation, and identify areas for further research and improved methodology.

/pdf/graphical-passwords-learning-from-the-first-twelve-years-1h8jsqlrwr.pdf

Graphical passwords: Learning from the first twelve years

We propose and examine the usability and security of Cued Click Points (CCP), a cued-recall graphical password technique. Users click on one point per image for a sequence of images. The next image is based on the previous click-point. We present the results of an initial user study which revealed positive results. Performance was very good in terms of speed, accuracy, and number of errors. Users preferred CCP to PassPoints (Wiedenbeck et al., 2005), saying that selecting and remembering only one point per image was easier, and that seeing each image triggered their memory of where the corresponding point was located. We also suggest that CCP provides greater security than PassPoints because the number of images increases the workload for attackers.

/pdf/graphical-password-authentication-using-cued-click-points-1v9207rrh3.pdf

Graphical password authentication using cued click points

Shoulder-surfing -- using direct observation techniques, such as looking over someone's shoulder, to get passwords, PINs and other sensitive personal information -- is a problem that has been difficult to overcome. When a user enters information using a keyboard, mouse, touch screen or any traditional input device, a malicious observer may be able to acquire the user's password credentials. We present EyePassword, a system that mitigates the issues of shoulder surfing via a novel approach to user input.With EyePassword, a user enters sensitive input (password, PIN, etc.) by selecting from an on-screen keyboard using only the orientation of their pupils (i.e. the position of their gaze on screen), making eavesdropping by a malicious observer largely impractical. We present a number of design choices and discuss their effect on usability and security. We conducted user studies to evaluate the speed, accuracy and user acceptance of our approach. Our results demonstrate that gaze-based password entry requires marginal additional time over using a keyboard, error rates are similar to those of using a keyboard and subjects preferred the gaze-based password entry approach over traditional methods.

/pdf/reducing-shoulder-surfing-by-using-gaze-based-password-entry-2pdqb0bc7u.pdf

Reducing shoulder-surfing by using gaze-based password entry

Security Visualization is a very young term. It expresses the idea that common visualization techniques have been designed for use cases that are not supportive of security-related data, demanding novel techniques fine tuned for the purpose of thorough analysis. Significant amount of work has been published in this area, but little work has been done to study this emerging visualization discipline. We offer a comprehensive review of network security visualization and provide a taxonomy in the form of five use-case classes encompassing nearly all recent works in this area. We outline the incorporated visualization techniques and data sources and provide an informative table to display our findings. From the analysis of these systems, we examine issues and concerns regarding network security visualization and provide guidelines and directions for future researchers and visual system developers.

A Survey of Visualization Systems for Network Security

We develop a model to identify the most likely regions for users to click in order to create graphical passwords in the PassPoints system. A PassPoints password is a sequence of points, chosen by a user in an image that is displayed on the screen. Our model predicts probabilities of likely click points; this enables us to predict the entropy of a click point in a graphical password for a given image. The model allows us to evaluate automatically whether a given image is well suited for the PassPoints system, and to analyze possible dictionary attacks against the system. We compare the predictions provided by our model to results of experiments involving human users. At this stage, our model and the experiments are small and limited; but they show that user choice can be modeled and that expansions of the model and the experiments are a promising direction of research.

/pdf/modeling-user-choice-in-the-passpoints-graphical-password-4lps6gk3io.pdf

Modeling user choice in the PassPoints graphical password scheme

The most common computer authentication method is to use alphanumerical usernames and passwords. This method has been shown to have significant drawbacks. For example, users tend to pick passwords that can be easily guessed. On the other hand, if a password is hard to guess, then it is often hard to remember. To address this problem, some researchers have developed authentication methods that use pictures as passwords. In this paper, we conduct a comprehensive survey of the existing graphical password techniques. We classify these techniques into two categories: recognition-based and recall-based approaches. We discuss the strengths and limitations of each method and point out the future research directions in this area. We also try to answer two important questions: "Are graphical passwords as secure as text-based passwords?"; "What are the major design and implementation issues for graphical passwords?" This survey will be useful for information security researchers and practitioners who are interested in finding an alternative to text-based authentication methods

/pdf/graphical-passwords-a-survey-1x52tm6oxe.pdf

Graphical passwords: a survey

In recent years, graphical passwords have become a viable alternative to the traditional text-based passwords due to their superior ease of recall and potential large password space. However, there is very limited research in classifying and mathematically analyzing the graphical password techniques. In this paper, we conduct a comprehensive study of the existing graphical password techniques. We propose the first taxonomy for graphical passwords methods and discuss the important elements in designing them. We present a mathematical analysis of the graphical password space. Finally we present a new graphical password scheme.

Analysis and Design of Graphical Password Techniques

Analysis and design of graphical password techniques

We present a novel method to measure the complexity of computer security visualization designs. The complexity is measured in terms of visual integration, number of separable dimensions for each visual unit, the complexity of interpreting the visual attributes, and the efficiency of visual search. Visualization developers can use this method to quickly evaluate multiple design choices in the early stage of their design before any user study can be conducted. To demonstrate this method, we have conducted complexity analysis on two open source security visualization tools – TNV and RUMINT.

Measuring the Complexity of Computer Security Visualization Designs

In this paper, we present a method for analyzing the complexity of information visualization. We have identified a number of factors that influence the efficiency of visual information read-off and integration. Here the complexity is measured in terms of visual integration, number of separable dimensions for each visual unit, the complexity of interpreting the visual attributes, and the efficiency of visual search. These measures are derived from well established psychological theories. Together they indicate the amount of cognitive load for comprehending a visualization design. This method is particularly useful for developers to quickly evaluate multiple design choices. Finally, we demonstrate our method through a complexity analysis on a computer security visualization program.

Xiaoyuan Suo

Papers

Graphical passwords: a survey

Analysis and Design of Graphical Password Techniques

Analysis and design of graphical password techniques

Measuring the Complexity of Computer Security Visualization Designs

Complexity analysis for information visualization design and evaluation