Towards a metric for recognition-based graphical password security

Abstract

Abstract-Recognition-based graphical password (RBGP) schemes are not easily compared in terms of security. Current research uses many different measures which results in confusion as to whether RBGP schemes are secure against guessing and capture attacks. If it were possible to measure all RBGP schemes in a common way it would provide an easy comparison between them, allowing selection of the most secure design. This paper presents a discussion of potential attacks against recognitionbased graphical password (RBGP) authentication schemes. As a result of this examination a preliminary measure of the security of a recognition-based scheme is presented. The security measure is a 4-tuple based on distractor selection, shoulder surfing, intersection and replay attacks. It is aimed to be an initial proposal and is designed in a way which is extensible and adjustable as further research in the area develops. Finally, an example is provided by application to the PassFaces scheme.

Continuous and transparent multimodal authentication: reviewing the state of the art

“…Moreover, poor selection of background images that have popular potential points yields to being easily predicted, for instance a study by [16] cracked an average of 7-10% of user passpoints (click-based) passwords within 3 guesses only. Fig.1 Pattern with the Possibility of Points to be Skipped [13] Further to the work on click-based concept, proposals about choice-based or PassImages graphical authentication have risen [17,18]; in addition to the recent application of the concept on Windows 8.1 Picture Password [19]. There are a set of images on sequential grids; the secret is among them in a form of a series of images that should be pressed or clicked on a specific order, one at each grid.…”

The Current Use of Authentication Technologies: An Investigative Review

“…Further to the work on click-based concept, proposals about choice-based or PassImages graphical authentication have risen [17], [18]. There are a set of images on sequential grids; the secret is among them in a form of a series of images that should be pressed or clicked on a specific order, one at each grid.…”

HashifyPass - Uma Ferramenta para Visualização de Hashes de Senhas

“…À direita a senha está exibida pelo fato da opc ¸ão "Mostrar senha" ter sido selecionada. Caso uma pessoa opte pela visualizac ¸ão da senha, como no caso exibido na Figura 1b, a autenticac ¸ão estará mais vulnerável a ataques de shoulder surfing [Bošnjak andBrumen 2020] [English andPoet 2011]. Nesse tipo de ataque, um atacante espiona o(a) usuário(a) de um dispositivo eletrônico a fim de obter informac ¸ões pessoais, como a senha por exemplo [Lexico 2022].…”

“…O HashifyPass leva em considerac ¸ão a importância da utilizac ¸ão de elementos gráficos para memorizac ¸ão de informac ¸ões de autenticac ¸ão mas, diferente dos setenta e sete trabalhos avaliados em [Bošnjak and Brumen 2020], esses elementos são aplicados para visualizac ¸ão do hash de uma senha textual, impedindo que um atacante seja capaz de descobrir a senha digitada. [English and Poet 2011] discute potenciais ataques contra esquemas de autenticac ¸ão que utilizam senhas gráficas. O modelo de ameac ¸as utilizado pelos autores considera shoulder surfing, ataques de intersecc ¸ão, escuta para posterior ataque de replay, phishing e táticas de engenharia social para adivinhar a senha.…”