Weak PassPoint Passwords Detected by the Perimeter of Delaunay Triangles

Abstract

PassPoint is a graphical authentication technique that is based on the selection of five points in an image. A detected vulnerability lies in the possible existence of a pattern in the points that make up the password. The objective of this work is to detect nonrandom graphical passwords in the PassPoint scenario. A spatial randomness test based on the average of Delaunay triangles’ perimeter is proposed, given the ineffectiveness of the classic tests in this scenario, which only consists of five points. A state-of-the-art of various applications of Voronoi polygons and Delaunay triangulations are presented to detect clustered and regular patterns. The distributions of the averages of the triangles’ perimeters in the PassPoint scenario for various sizes of images are disclosed, which were unknown. The test’s decision criterion was constructed from one of the best distributions to which the data were adjusted. Type I and type II errors were estimated, and it was concluded that the proposed test could detect clustered and regular graphical passwords in PassPoint, therefore being more effective in detecting clustering than regularity.

New Test to Detect Graphic Passwords Clustered in Passpoints, Based on the Perimeter of the Convex Hull

“…Only users with high or medium authenticity levels are authenticated based on the results obtained. In [10] and [11], two spatial randomness tests were introduced to identify non-random, clustered, and regular graphical passwords in Passpoints. These tests were developed in response to the limited effectiveness of traditional tests in verifying complete spatial randomness in this specific scenario [10,12].…”

“…A test was proposed in [11] that is based on the average of the perimeters of the Delaunay triangles. The study focuses on identifying non-random graphic passwords composed of five clustered or regularly positioned points.…”

“…The test proposed in this article was compared to previous methods in terms of its effectiveness in detecting clustered graphic passwords and its efficiency. For this study, the tests to be compared will be denoted as follows: Test 1, which is based on the average distance between the points [10]; Test 2, which is based on the average of the perimeters of the Delaunay triangle [11]; Test 3, which is the joint application of the previous tests [13]; and Test 4, which is the test proposed in this study. Of the references consulted, the one that has shown the highest effectiveness is test 3.…”