A second look at the usability of click-based graphical passwords

Abstract

Click-based graphical passwords, which involve clicking a set of user-selected points, have been proposed as a usable alternative to text passwords. We conducted two user studies: an initial lab study to revisit these usability claims, explore for the first time the impact on usability of a wide-range of images, and gather information about the points selected by users; and a large-scale field study to examine how click-based graphical passwords work in practice. No such prior field studies have been reported in the literature. We found significant differences in the usability results of the two studies, providing empirical evidence that relying solely on lab studies for security interfaces can be problematic. We also present a first look at whether interference from having multiple graphical passwords affects usability and whether more memorable passwords are necessarily weaker in terms of security.

Graphical Cipher Ratification System

“…These results compare well with earlier work such as PassPoints [21], which yielded mean ratification times of 8.78-24.25s and 1.55-2.75 failed ratification attempts prior to successfully entering a cipher. Similarly, Chiasson et al [6] present a lab study of click-point-based graphical ciphers using multiple images and report a median ratification time of 7s and an error rate of 6%. In summary, this paper proposed improving the security of graphical cipher systems by integrating live display of a graphical object that a user picks.…”

“…As variations in tokens are inevitable with the Graphical Cipher Ratification System's setup, we also explored the robustness of the system in the case of repeated images with different point selections. 1) Materials: Five source images were selected based on the image categories with highest success rate in prior work [6]. They depicted people, food, tiny objects, and random text.…”

“…The first involved the use of a public system assigned image representing a crowd of people, as in [6], while the second concerned the use of a private personally chosen image, in this case a bowl of fruits. We state that the public plot imitates the case of the usual cued-recall graphical passwords, where the images used for verification are stored on a server and revealed at ratification time.…”

“…However, graphical passwords have their issues. One such issue is their sensitivity to intelligent guessing [5], [6], [23] and shoulder-surfing attacks [22]. These attacks are valid since the portions of images that are chosen by the users as password items are easy for an attacker to notice by intruding over shoulders or through camera surveillance to record input and are also comparatively predictable [20], [23].…”

Methodology for a Field Study of Anti-malware Software

“…Recent field studies of security software have mostly involved evaluating the use of authentication mechanisms [3,6,4]. In 2009, Somayaji et al [11] introduced the concept of computer security clinical trials.…”