On the Use of Emojis in Mobile Authentication

Abstract

Mobile authentication methods protect smartphones from unauthorized access, but also require users to remember and frequently enter PINs, passwords, or graphical patterns. We propose the EmojiAuth scheme with which we study the effects of Emoji use on the usability and user experience of mobile authentication. We conducted two between-subjects studies (lab study: n=53; field study: n=41) comparing EmojiAuth to standard PIN entry. We find that Emo-jiAuth provides good memorability for short passwords and reasonable memorability for longer passwords. Moreover, we identify diverse Emoji-password selection strategies and provide insights on the practical security of Emoji-based mobile authentication. Our results suggest that Emoji-based authentication constitutes a practical alternative to traditional PIN authentication.

EmojiAuth: Quantifying the Security of Emoji-based Authentication

“…Markov models have proven a useful tool to model userchosen authentication secrets in the past, both for passwords [21], [17], [11] and Android Unlock patterns [30]. We expect them to provide reasonable predictions for the studied EmojiAuth scheme as well, specifically in the light of previous work by Kraus et al [15] which found that common (self-reported) strategies for selecting passcodes were based on creating a story, repeating events of my life, and visual patterns "A-B-A-B". (Note that other common strategies did not necessarily involve a specific order of emoji, such as important things of their lives or tried to select a random passcode, and are thus less well modeled by Markov models.…”

“…In this study, we concentrated on the security of the EmojiAuth scheme, as previous work found that EmojiAuth (with 12 emoji) "provides login times comparable to PIN and reasonable memorability" [15]. We found that the security is substantially higher than for similar systems, specifically Android's graphical authentication scheme [30] and user-chosen 4-digit PINs [6].…”

“…We developed an instantiation of an emoji-based authentication scheme to evaluate its security. Previous instantiations were studied by Kraus et al [15] (abbreviated KS) and announced by Intelligent Environments Ltd. [12] (IE) to enable consumers to log into their banks using four emoji characters. The number of emoji offered to the user varies widely between both schemes (KS offers 12 emoji, while IE offers 44 emoji).…”

“…Figure 3 visualizes the structure of 2-grams observed in the user study passcode data. As stated by Kraus et al [15] there is a variety of emoji passcode selection strategies. Due to the questionnaire we identified the following strategies: • Positions within the grid (19) • Emoji I like the most (17) • Emoji I find hilarious and funny (6) • Emoji of the same color (3)…”

“…Previous work [15] indicates that emoji-based authentication schemes can offer login times comparable to classical PIN entry, and reasonable memorability, at the same time offering a larger theoretical keyspace and thus potentially more security against guessing attacks. However, it is wellknown that user-chosen authentication secrets are usually not distributed uniformly over the theoretical space of secrets (cf.…”