Exploring the Acceptability of Graphical Passwords for People with Dyslexia

Abstract

Alphanumeric passwords are still the most common form of user authentication despite well-known usability issues. These issues, including weak composition and poor memorability, have been well-established across different user groups, yet users with dyslexia have not been studied despite making up approximately 10% of the population. In this paper, we focus on understanding the user authentication experiences of people with dyslexia (PwD) in order to better understanding their attitudes towards a graphical password system that may provide a more inclusive experience. Through interactive interviews, participants were encouraged to try three different knowledge-based authentication systems (PIN, password, and graphical password) and then discuss their strategies behind code composition. We found that PwD employed potentially dangerous workarounds when composing passwords, in particular an over-reliance on pattern-based composition. We report on how PwD do not immediately see the benefits of graphical passwords, but upon experiencing the mechanism we see opportunities for more inclusive authentication.

“As Usual, I Needed Assistance of a Seeing Person”: Experiences and Challenges of People with Disabilities and Authentication Methods

“…Investigating the relationship between cognitive decline in ageing and KBA, Nicholson et al [47], [48] found that older adults show poorer performance compared to younger adults, regardless of the authentication method. They -similar to Evtimova & Nicholson [22] -suggest that graphical passwords may benefit their participants. Our study adds to this body of work by applying a socio-technical lens to shed light on the experiences with (in-)accessible authentication of people with various impairments and possible venture points for improvement.…”

“…The majority stem from usability issues -such as compatibility problems with assistive technologies (P7), lack of contrast on the smartphone keyboards (P12, P13), non-readable password fields (P1, P10), or solving CAPTCHAs in the enrolment or authentication process (P5, P8, P9) -that have also been identified by other research, e.g., [20], [61]. These also have an effect on security, e.g., similar to people with dyslexia [22], [39], [52], [57] P1, with learning difficulties, finds it hard to create and remember secure passwords, so they reduce the length of the passwords and choose family names or a date of birth as a password to be able to memorize it easily. Such adaptations commonly come at the cost of security, as shown in P1's experience:…”

“…Cognitive Impairments. Recently, researchers started to look more closely at the needs of people with cognitive impairments, such as dyslexia [22], [32], [39], [52], [57]. Hayes et al [32], Renaud et al [57], and Ophoff et al [52] found that difficulties occur in entering passwords, memorizing patterns, PINs, tokens, and identifying objects in pictures (CAPTCHAs).…”

“…Especially multi-factor authentication (MFA) posed challenges for people with dyslexia, e.g., in memorizing and entering one-time passwords (OTP). Evtimova & Nicholson [22] found that people with dyslexia engaged in potentially dangerous workarounds when creating passwords, engaged in password re-use, and need more time in the authentication process. Investigating the relationship between cognitive decline in ageing and KBA, Nicholson et al [47], [48] found that older adults show poorer performance compared to younger adults, regardless of the authentication method.…”

Efficient Special Character Entry on a Virtual Keyboard by Hand Gesture-Based Mode Switching

“…George et al [11] suggested authentication by connecting 3D objects in the virtual space as a method to leverage all three dimensions. Evtimova and Nicholson [8] proposed graphical passwords based on 2D images for users who have difficulty reading and memorizing text. There has been little research attention given to improving the typing experience of text-based passwords, despite the fact that this still remains the most common method of authentication.…”