Design and evaluation of a shoulder-surfing resistant graphical password scheme