The Role of Eye Gaze in Security and Privacy Applications: Survey and Future HCI Research Directions

Abstract

For the past 20 years, researchers have investigated the use of eye tracking in security applications. We present a holistic view on gaze-based security applications. In particular, we canvassed the literature and classify the utility of gaze in security applications into a) authentication, b) privacy protection, and c) gaze monitoring during security critical tasks. This allows us to chart several research directions, most importantly 1) conducting field studies of implicit and explicit gaze-based authentication due to recent advances in eye tracking, 2) research on gaze-based privacy protection and gaze monitoring in security critical tasks which are under-investigated yet very promising areas, and 3) understanding the privacy implications of pervasive eye tracking. We discuss the most promising opportunities and most pressing challenges of eye tracking for security that will shape research in gaze-based security applications for the next decade.

Are Thermal Attacks Ubiquitous?

“…The security of graphical passwords can be improved by, for example, using contactless input for, such as eye gaze or mid-air gestures. Indeed, one direction to address thermal attacks is to employ schemes that use modalities that do not leave heat traces [9,10,14,19]. An alternative could be to use cue-based authentication where the user's input depends on system cues [7,20,25,27].…”

A Camouflage Text-Based Password Approach for Mobile Devices against Shoulder-Surfing Attack

“…Also, Kumar et al presented in [23] a Gaze-Based password entry approach in order to prevent the shoulder-surfing attack. A survey on gaze-based security applications was carried out in [24] that discussed a set of opportunities as well as challenges. Likewise, the gazebased application is reviewed in [25] and classified into three categories: authentication, privacy, and gaze monitoring.…”

GazeLockPatterns: Comparing Authentication Using Gaze and Touch for Entering Lock Patterns

“…A recent survey on eye gaze for security and privacy applications [Katsini et al 2020] showed that gaze is promising for password entry. In addition to usability benefits, gaze is subtle and hard to observe, and can be a powerful means to add biometrics as a layer on top of gaze-based passwords.…”

“…This resulted in an understanding of how strong the TouchLockPatterns users create are, common pitfalls, and areas of improvement. At the same time, advances in gaze estimation accuracy and eye tracking hardware led to gaze gaining popularity for authentication as a more natural and secure modality for entering passwords [Katsini et al 2020]. Gaze offers usability advantages Figure 1: Study setup where we investigate the difference between using gaze and touch for entering lock patterns over traditional modalities such as touch and pointing (e.g., mouse) and its subtleness makes it more secure against observation attacks.…”