Touch screens are an increasingly common feature on personal computing devices, especially smartphones, where size and user interface advantages accrue from consolidating multiple hardware components (keyboard, number pad, etc.) into a single software definable user interface. Oily residues, or smudges, on the touch screen surface, are one side effect of touches from which frequently used patterns such as a graphical password might be inferred.

In this paper we examine the feasibility of such smudge attacks on touch screens for smartphones, and focus our analysis on the Android password pattern. We first investigate the conditions (e.g., lighting and camera orientation) under which smudges are easily extracted. In the vast majority of settings, partial or complete patterns are easily retrieved. We also emulate usage situations that interfere with pattern identification, and show that pattern smudges continue to be recognizable. Finally, we provide a preliminary analysis of applying the information learned in a smudge attack to guessing an Android password pattern.

/pdf/smudge-attacks-on-smartphone-touch-screens-nu9zme64p0.pdf

Smudge attacks on smartphone touch screens

Starting around 1999, a great many graphical password schemes have been proposed as alternatives to text-based password authentication. We provide a comprehensive overview of published research in the area, covering both usability and security aspects as well as system evaluation. The article first catalogues existing approaches, highlighting novel features of selected schemes and identifying key usability or security advantages. We then review usability requirements for knowledge-based authentication as they apply to graphical passwords, identify security threats that such systems must address and review known attacks, discuss methodological issues related to empirical evaluation, and identify areas for further research and improved methodology.

/pdf/graphical-passwords-learning-from-the-first-twelve-years-1h8jsqlrwr.pdf

Graphical passwords: Learning from the first twelve years

Graphical passwords were proposed as an alternative to overcome the inherent limitations of text-based passwords, inspired by research that shows that the graphical memory of humans is particularly well developed. A graphical password scheme that has been widely adopted is the Android Unlock Pattern, a special case of the Pass-Go scheme with grid size restricted to 3x3 points and restricted stroke count.In this paper, we study the security of Android unlock patterns. By performing a large-scale user study, we measure actual user choices of patterns instead of theoretical considerations on password spaces. From this data we construct a model based on Markov chains that enables us to quantify the strength of Android unlock patterns. We found empirically that there is a high bias in the pattern selection process, e.g., the upper left corner and three-point long straight lines are very typical selection strategies. Consequently, the entropy of patterns is rather low, and our results indicate that the security offered by the scheme is less than the security of only three digit randomly-assigned PINs for guessing 20% of all passwords (i.e., we estimate a partial guessing entropy G_0.2 of 9.10 bit).Based on these insights, we systematically improve the scheme by finding a small, but still effective change in the pattern layout that makes graphical user logins substantially more secure. By means of another user study, we show that some changes improve the security by more than doubling the space of actually used passwords (i.e., increasing the partial guessing entropy G_0.2 to 10.81 bit).

https://www.ei.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2013/09/26/patternLogin-CCS13.pdf

Quantifying the security of graphical passwords: the case of android unlock patterns

The construction industry is known to be overwhelmed with resource planning, risk management and logistic challenges which often result in design defects, project delivery delays, cost overruns and contractual disputes. These challenges have instigated research in the application of advanced machine learning algorithms such as deep learning to help with diagnostic and prescriptive analysis of causes and preventive measures. However, the publicity created by tech firms like Google, Facebook and Amazon about Artificial Intelligence and applications to unstructured data is not the end of the field. There abound many applications of deep learning, particularly within the construction sector in areas such as site planning and management, health and safety and construction cost prediction, which are yet to be explored. The overall aim of this article was to review existing studies that have applied deep learning to prevalent construction challenges like structural health monitoring, construction site safety, building occupancy modelling and energy demand prediction. To the best of our knowledge, there is currently no extensive survey of the applications of deep learning techniques within the construction industry. This review would inspire future research into how best to apply image processing, computer vision, natural language processing techniques of deep learning to numerous challenges in the industry. Limitations of deep learning such as the black box challenge, ethics and GDPR, cybersecurity and cost, that can be expected by construction researchers and practitioners when adopting some of these techniques were also discussed.

Deep Learning in the Construction Industry: A Review of Present Status and Future Innovations

In this paper, we consider the flow shop scheduling problem with respect to the both objectives of makespan and total flowtime. This problem is known to be NP-hard type in literature. Several algorithms have been proposed to solve this problem. We present a multi-objective ant colony system algorithm (MOACSA), which combines ant colony optimization approach and a local search strategy in order to solve this scheduling problem. The proposed algorithm is tested with well-known problems in literature. Its solution performance was compared with the existing multi-objective heuristics. The computational results show that proposed algorithm is more efficient and better than other methods compared.

A multi-objective ant colony system algorithm for flow shop scheduling problem

Alphanumeric passwords are widely used in computer and network authentication to protect users' privacy. However, it is well known that long, text-based passwords are hard for people to remember, while shorter ones are susceptible to attack. Graphical password is a promising solution to this problem. Draw-A-Secret (DAS) is a typical implementation based on the user drawing on a grid canvas. Currently, too many constraints result in reduction in user experience and prevent its popularity. A novel graphical password strategy Yet Another Graphical Password (YAGP) inspired by DAS is proposed in this paper. The proposal has the advantages of free drawing positions, strong shoulder surfing resistance and large password space. Experiments illustrate the effectiveness of YAGP.

YAGP: Yet Another Graphical Password Strategy

Shoulder-surfing is a known risk where an attacker can capture a password by direct observation or by recording the authentication session. Due to the visual interface, this problem has become exacerbated in graphical passwords. There have been some graphical schemes resistant or immune to shoulder-surfing, but they have significant usability drawbacks, usually in the time and effort to log in. In this paper, we propose and evaluate a new shoulder-surfing resistant scheme which has a desirable usability for PDAs. Our inspiration comes from the drawing input method in DAS and the association mnemonics in Story for sequence retrieval. The new scheme requires users to draw a curve across their password images orderly rather than click directly on them. The drawing input trick along with the complementary measures, such as erasing the drawing trace, displaying degraded images, and starting and ending with randomly designated images provide a good resistance to shouldersurfing. A preliminary user study showed that users were able to enter their passwords accurately and to remember them over time.

A New Graphical Password Scheme Resistant to Shoulder-Surfing

Shoulder-surfing is a known risk where an attacker can capture a password by direct observation or by recording the authentication session. Due to the visual interface, this problem has become exacerbated in graphical passwords. There have been some graphical schemes resistant or immune to shoulder-surfing, but they have significant usability drawbacks, usually in the time and effort to log in. In this paper, we propose and evaluate a new shoulder-surfing resistant scheme which has a desirable usability for PDAs. Our inspiration comes from the drawing input method in DAS and the association mnemonics in Story for sequence retrieval. The new scheme requires users to draw a curve across their password images orderly rather than click directly on them. The drawing input trick along with the complementary measures, such as erasing the drawing trace, displaying degraded images, and starting and ending with randomly designated images provide a good resistance to shoulder-surfing. A preliminary user study showed that users were able to enter their passwords accurately and to remember them over time.

/pdf/a-new-graphical-password-scheme-resistant-to-shoulder-153uotcqsv.pdf

Graphical passwords are believed to be more secure than traditional textual passwords, but the authentications are usually complex and boring for users. Furthermore, most of the existing graphical password schemes are vulnerable to spyware and shoulder surfing. A novel graphical password scheme ColorLogin is proposed in this paper. ColorLogin is implemented in an interesting game way to weaken the boring feelings of the authentication. ColorLogin uses background color, a method not previously considered, to decrease login time greatly. Multiple colors are used to confuse the peepers, while not burdening the legitimate users. Meanwhile, the scheme is resistant to shoulder surfing and intersection attack to a certain extent. Experiments illustrate the effectiveness of ColorLogin.

Design and Analysis of a Graphical Password Scheme

CAPTCHAs are employed as a security measure to differentiate human users from bots. A new sound-based CAPTCHA is proposed in this paper, which exploits the gaps between human voice and synthetic voice rather than relays on the auditory perception of human. The user is required to read out a given sentence, which is selected randomly from a specified book. The generated audio file will be analyzed automatically to judge whether the user is a human or not. In this paper, the design of the new CAPTCHA, the analysis of the audio files, and the choice of the audio frame window function are described in detail. And also, some experiments are conducted to fix the critical threshold and the coefficients of three indicators to ensure the security. The proposed audio CAPTCHA is proved accessible to users. The user study has shown that the human success rate reaches approximately 97% and the pass rate of attack software using Microsoft SDK 5.1 is only 4%. The experiments also indicated that it could be solved by most human users in less than 14 seconds and the average time is only 7.8 seconds.

/pdf/an-audio-captcha-to-distinguish-humans-from-computers-14l7why9oc.pdf

Xiyang Liu

Papers

YAGP: Yet Another Graphical Password Strategy

A New Graphical Password Scheme Resistant to Shoulder-Surfing

A New Graphical Password Scheme Resistant to Shoulder-Surfing

Design and Analysis of a Graphical Password Scheme

An Audio CAPTCHA to Distinguish Humans from Computers