A closer look at recognition-based graphical passwords on mobile devices

Graphical password systems based on the recognition of photographs are candidates to alleviate current over-reliance on alphanumeric passwords and PINs. However, despite being based on a simple concept – and user evaluations consistently reporting impressive memory retention – only one commercial example exists and overall take-up is low. Barriers to uptake include a perceived vulnerability to observation attacks; issues regarding deployability; and the impact of innocuous design decisions on security not being formalized. Our contribution is to dissect each of these issues in the context of mobile devices – a particularly suitable application domain due to their increasing significance, and high potential to attract unauthorized access. This produces: 1) A novel yet simple solution to the intersection attack that permits greater variability in login challenges; 2) Detailed analysis of the shoulder surfing threat that considers both simulated and human testing; 3) A first loo...

• Type: Conference
• Year: 2010
• Where: SOUPS
• Authors: Paul Dunphy, Andreas P. Heiner, N. Asokan
• Keywords: Graphical Passwords, Mobile Devices, Security Privacy, Shoulder Surfing, SOUPS 2010