A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords

Previous research has found graphical passwords to be more memorable than non-dictionary or “strong” alphanumeric passwords. Participants in a prior study expressed concerns that this increase in memorability could also lead to an increased susceptibility of graphical passwords to shoulder-surfing. This appears to be yet another example of the classic trade-off between usability and security for authentication systems. This paper explores whether graphical passwords’ increased memorability necessarily leads to risks of shoulder-surfing. To date, there are no studies examining the vulnerability of graphical versus alphanumeric passwords to shoulder-surfing. This paper examines the real and perceived vulnerability to shoulder-surfing of two configurations of a graphical password, Passfaces™[30], compared to non-dictionary and dictionary passwords. A laboratory experiment with 20 participants asked them to try to shoulder surf the two configurations of Passfaces™ (mouse versus ...

• Type: Conference
• Year: 2006
• Where: SOUPS
• Authors: Furkan Tari, A. Ant Ozok, Stephen H. Holden
• Keywords: Alphanumeric Passwords, Graphical Password, SOUPS 2006, Study Participants