Increasing the security of gaze-based cued-recall graphical passwords using saliency masks

AbstractThere is evidence that the visual behavior of users when creating graphical passwords affects the password strength. Adopting a cognitive style perspective in the interpretation of the results of recent studies revealed that users, depending on their cognitive style, follow different visual exploration paths when creating graphical passwords which affected the password strength. To take advantage of the inherent abilities of people, we proposed CogniPGA, a cued-recall graphical authentication scheme where a cognition-based intervention using gaze data is applied. This paper presents the longitudinal evaluation of the proposed scheme in terms of security, memorability, and usability from a cognitive style perspective. Results strengthen the assumptions that understanding and using the inherent cognitive characteristics of users could enable the design of user-first authentication schemes, where no compromises need to be made on security for benefiting usability or the other way around.

Download Full-text

Shoulder-surfing resistance with eye-gaze entry in cued-recall graphical passwords

Proceedings of the 28th international conference on Human factors in computing systems - CHI '10 ◽

10.1145/1753326.1753491 ◽

2010 ◽

Cited By ~ 48

Author(s):

Alain Forget ◽

Sonia Chiasson ◽

Robert Biddle

Keyword(s):

Eye Gaze ◽

Cued Recall ◽

Graphical Passwords ◽

Shoulder Surfing

Download Full-text

GridMap: Enhanced Security in Cued-Recall Graphical Passwords

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering - International Conference on Security and Privacy in Communication Networks ◽

10.1007/978-3-319-23829-6_6 ◽

2015 ◽

pp. 75-94

Author(s):

Nicolas Van Balen ◽

Haining Wang

Keyword(s):

Cued Recall ◽

Graphical Passwords

Download Full-text

Password Entry Times for Recognition-based Graphical Passwords

Proceedings of the Human Factors and Ergonomics Society Annual Meeting ◽

10.1177/1541931213601173 ◽

2016 ◽

Vol 60 (1) ◽

pp. 755-759 ◽

Cited By ~ 2

Author(s):

Steffen Werner ◽

Christopher Hauck ◽

Marshall Masingale

Keyword(s):

Lower Limit ◽

Cued Recall ◽

Graphical Passwords ◽

Entry Speed ◽

User Friendly

Graphical passwords offer a more memorable alternative to traditional, text-based passwords. Among current contenders, cued-recall based click-point or gesture centered authentication systems like Microsoft’s picture gesture authentication (PGA) have been commercially more successful than recognition based systems (e.g., PassFaces). One perceived drawback of graphical authentication systems in general and especially recognition based authentication is the assumption that graphical authentication is slower and thus less user-friendly than traditional password entry via keyboard. This paper addresses these concerns and demonstrates a lower limit for recognition-based password entry times achievable with sufficient practice. While slightly slower than traditional keyboard based passwords, the entry speed of often-used graphical passwords is shown to reach 10 bits/s in an optimized configuration, which is sufficient for everyday use (3-6s per authentication sequence @ 36 bits) and exceeds the reported speed of similarly secure text-based passwords on non-traditional devices using virtual keyboards.

Download Full-text