Graphical Passwords

Getting users to abandon text-based passwords has been a rather difficult task. Several alternatives to textual passwords have been proposed including authentication based on images. Research shows that graphical authentication mechanisms have some advantages, but they lack the necessary qualities to move them from isolated to mass market environments. This paper builds on current research and previous papers and presents the second iteration of ImagePass, a novel graphical authentication mechanism that follows usable security guidelines. Based on ambitious usability tests this approach has been demonstrated as a feasible authentication alternative for desktop and mobile environments.

This research examined factors which affected password creation using images on a grid. The experiment was carried out with 1,069 participants, by simulating a game of recalling pictures and using a questionnaire to gather users' feedback. A mixed-model experimental design was employed in this research. There were two experimental groups. The participants were randomly assigned into a group. The participants in the first group would have to memorize and recall human images, while the participants in the second group would have to do with images of objects instead. There were two kinds of grids, including a square and a non-square form. The participants would have to remember five images which were displayed on a grid. They would have to finish 6 trials and then they were asked to answer the questionnaire. The results indicated that a factor of image types (human and object images) did not affect the number of recalled pictures on any type of grid forms. However, the results showed that a factor of different grid forms did affect the number of recalled pictures. The participants could recall more pictures displayed on the square grids than displayed on the non-square grids significantly. Interestingly, in the further analysis of a grid size of between a 4x4 square and a 5x5 square form, there was no effect of a grid-size factor on the number of recalled pictures.

One of the most important topics in information security today is user authentication. User authentication is a fundamental component in most computer security contexts. It provides the basis for access control and user accountability. While there are various types of user authentication systems, alphanumeric passwords are the most common type of user authentication. They are versatile and easy to implement and use. However, it can either be long and secure or short and hard to remember. A graphical based password is one promising alternatives of textual passwords. According to human psychology, humans are able to remember pictures easily. In this paper, graphical passwords have been designed to try to make password more memorable and easier for people to use, and it is less vulnerable to brute force attacks than a text based password. The aim of the system is to implement a strong security. The proposed system segments the image like a grid, which has a maximum four fragments. Then...

Users gain access to cash, confidential information and services at Automated Teller Machines (ATMs) via an authentication process involving a Personal Identification Number (PIN). These users frequently have many different PINs, and fail to remember them without recourse to insecure behaviours. This is not a failing of users. It is a usability failing in the ATM authentication mechanism.
This paper describes research executed to evaluate whether users find multiple graphical passwords more memorable than multiple PINs. The research also investigates the success of two memory augmentation strategies in increasing memorability of graphical passwords. The results demonstrate that multiple graphical passwords are substantially more effective than multiple PIN numbers. Memorability is further improved by the use of mnemonics to aid their recall.
This study will be of interest to HCI practitioners and information security researchers exploring approaches to usable security.

Existing graphical authentication methods take into account the fact that users are more capable of remembering pictures instead of text. Graphical authentication schemes are expected to be less vulnerable to specific hacker attack techniques that have greatly improved in recent years. The usability aspect of a graphical authentication product refers to the extent that a product can be used by users to achieve goals with effectiveness, efficiency and satisfaction in a specified context of use. This paper describes a prototype system providing graphical authentication of mobile devices over the Internet, covering both usability and security aspects. Color images are assigned to the mobile users and authentication is achieved by modifying the Red-Green-Blue (RGB) color intensity values of the assigned image.

Username and password are the most commonly used mechanism for authentication because of simplicity and convenience. However it suffers from few drawbacks like selection of weak passwords by the users, users disclosing their passwords etc. This weakens the security posture of the organizations. Hence we propose a new image based authentication system. Research suggests that use of images may be more effective in terms of security and ease of use for some application. This is because we, humans are good at recognizing images than remembering password. In this paper we describe new image based authentication system which can be used independently or along with current character based authentication system to improve security and usability. We implemented the said system along with current authentication system (username and password). We carried out the user survey. Around seventy users including students and faculty tested the system and gave their feedback. After analysis, One of th...

The password the almost universal authentication solution yet is buckling under the strain. It demonstrates insufficiency and weakness due to poor choice, reuse and ease of transfer. Graphical passwords, biometrics, and hardware tokens have been suggested as alternatives. Industry has, unfortunately, not embraced these alternatives. One possible explanation is the complexity of the choice process. To support authentication decision-markers we suggest a framework called ACCESS (Authentication ChoiCE Support System) which captures requirements, consults a knowledge base of existing authentication mechanisms and their properties, and suggests those mechanisms that match the specified requirements.

In this article we present the development of a new, web-based, graphical authentication mechanism called ImagePass. The authentication mechanism introduces a novel feature based on one-time passwords that increases the security of the system without compromising its usability. Regarding usability, we explore the users’ perception of recognition-based, graphical authentication mechanisms in a web environment. Specifically, we investigate whether the memorability of recognition-based authentication keys is influenced by image content. We also examine how the frequency of use affects the usability of the system and whether user training via mnemonic instructions improves the graphical password recognition rate. The design and development process of the proposed system began with a study that assessed how the users remember abstract, face or single-object images, and showed that single-object images have a higher memorability rate. We then proceeded with the design and development of a recognition-based graphical authentication mechanism, ImagePass, which uses single-objects as the image content and follows usable security guidelines. To conclude the research, in a follow-up study we evaluated the performance of 151 participants under different conditions. We discovered that the frequency of use had a great impact on users’ performance, while the users’ gender had a limited task-specific effect. In contrast, user training through mnemonic instructions showed no differences in the users’ authentication metrics. However, a post-study, focus-group analysis revealed that these instructions greatly influenced the users’ perception for memorability and the usability of the graphical authentication. In general, the results of these studies suggest that single-object graphical authentication can be a complementary replacement for traditional passwords, especially in ubiquitous environments and mobile devices.

Researchers have developed various graphical authentication mechanisms, with varied results in different environments. However, it has been difficult to get users to abandon traditional text-passwords in favor of something unfamiliar, therefore limiting graphical passwords to isolated environments rather than mass market solutions. Current studies show that while dominant on the usability side, because of their intuitiveness and potential password space, graphical authentication mechanisms are not necessarily more secure. This paper presents the development of a graphical authentication prototype by following usable security guidelines. Codenamed ImagePass, the prototype is a mechanism that uses image recognition as the basis for the authentication process.

As users can only make informed choices when the proposals being discussed are meaningful to them, enabling users to envision and make sense of those proposals is an essential element of all approaches to system design. The focus of this study is the conceptualization of a graphical authentication mechanism appropriate for ubiquitous environments. Therefore, the experiment presented in this paper uses the paper prototyping method is used to effectively simulate graphical authentication and distinguish the user preference between two system approaches in ubiquitous environments. Complementary, both a high fidelity paper and a mobile prototype is used in order to evaluate popular graphical authentication concepts which are based on separate cognitive functions: recall and recognition. This experiment uses a between group design where each participant evaluates a prototype for both authentication concepts in the same medium. The results of the study demonstrate that recognition-based graphical authentication mechanisms are more suitable for ubiquitous environments than recall-based systems.

Abstract: Recently, with the awareness of businessmen and consumers and the development of mobile technologies, the potential use of mobile devices in financial applications such as banking and stock trading has seen a rapid increase. However, the security challenges being faced are diverse and increasing in number because of huge amount of money flowing across the mobiles. There have been several attempts in the field to preserve anonymity of user and protect them from several attacks but due to many security flaws these schemes are not feasible for real-life implementation. In this paper we focus on mobile banking and provide a scheme based on Cued Click Points authentication for a user. We also propose the use of steganography as a means to improve the communication channel for any intrusion by the hackers.

There have been numerous attempts to replace or re-design knowledge-based authentication. Despite these endeavours, driven by known usability and security weaknesses, traditional password-based systems have remained ubiquitous. Graphical passwords have emerged and re-emerged in different forms as a proposed solution. The broad argument is that such passwords should be easier to remember, easier to use, and more secure. Psychological jargon is often used to justify these claims, but what does the real psychology suggest?

Abstract: Passwords provide security mechanism for authentication and protection services against unwanted access to resources. A graphical based password is one promising alternatives of textual passwords. According to human psychology, humans are able to remember pictures easily. In this paper, we have proposed a new hybrid graphical password based system, which is a combination of recognition and recall based techniques that offers many advantages over the existing systems and may be more convenient for the user. Our ...

This paper tries to point out flashy topics in an authentication system that works by having the user select from images, in a specific pattern (order), presented in a Graphical User Interface (GUI). So that the graphical password approach is called Graphical Image Authentication (GIA). The most common authentication method is to use alpha-numerical passwords. For example user tends to choose passwords that can be easily guessed on the other hand, if a password is difficult to guess then it is often difficult to remember. To overcome this problem of low security, Authentication methods change from images to passwords. Because humans can remember visuals (patterns) better than text, graphical password schemes have been offered as a feasible replacement to text-based systems. Visual patterns, rather than specific images, are easier to remember.Patterns are general easier to remembered or recognized than text. This early study implies that many graphics in graphical password systems may support memorability.

Existing graphical authentication methods take into account the fact that users are more capable of remembering pictures instead of text. Graphical authentication schemes are expected to be less vulnerable to specific hacker attack techniques that have greatly improved in recent years. The usability aspect of a graphical authentication product refers to the extent that a product can be used by users to achieve goals with effectiveness, efficiency and satisfaction in a specified context of use. This paper describes a prototype system providing graphical authentication of mobile devices over the Internet, covering both usability and security aspects. Color images are assigned to the mobile users and authentication is achieved by modifying the Red-Green Blue (RGB) color intensity values of the assigned image.