No abstract

No abstract

is a PhD candidate in the electrical engineering department at Stanford University and is one of the student leads in the interactive workspaces project. His research interests include genetic programming, computer networking, and computer graphics. He received a BA in computer science and a BS in electrical engineering and computer science from Cornell University, an MS in computer science from the University of Birmingham in England, and an MS in electrical engineering from Stanford University. Contact him at bjohanso@graphics.stanford.edu.Armando Fox is an assistant professor at Stanford University. His research interests include systems approaches to improving dependability and system software support for ubiquitous computing. He received a BS in electrical engineering from MIT, an MS in electrical engineering from the University of Illinois, and a PhD in electrical engineering from the University of California at Berkeley. He is a member of the ACM and a founder of ProxiNet (now a division of PumaTech), which commercialized the thin client mobile computing technology he helped develop at UC Berkeley. Contact him at fox@cs.stanford.edu.Terry Winograd is a professor of computer science at Stanford University, where he directs the interactivity laboratory and the program in human-computer interaction design. He is one of the principal investigators in the Stanford digital libraries project and the interactive workspaces project. His research interests include human-computer interaction design, with a focus on the theoretical background and conceptual models. Contact him at winograd@cs.stanford.edu. the AUTHORS

No abstract

Shoulder-surfing-using direct observation techniques, such as looking over someone's shoulder, to get passwords, PINs and other sensitive personal information-is a problem that has been difficult to overcome. When a user enters information using a keyboard, mouse, touch screen or any traditional input device, a malicious observer may be able to acquire the user's password credentials. We present EyePassword, a system that mitigates the issues of shoulder surfing via a novel approach to user input. With EyePassword, a user enters sensitive input (password, PIN, etc.) by selecting from an on-screen keyboard using only the orientation of their pupils (i.e. the position of their gaze on screen), making eavesdropping by a malicious observer largely impractical. We present a number of design choices and discuss their effect on usability and security. We conducted user studies to evaluate the speed, accuracy and user acceptance of our approach. Our results demonstrate that gaze-based password entry requires marginal additional time over using a keyboard, error rates are similar to those of using a keyboard and subjects preferred the gaze-based password entry approach over traditional methods.