Evaluating the usability and security of a graphical one-time PIN system

Abstract

Traditional Personal Identification Numbers (PINs) are widely used, but the attacks in which they are captured have been increasing. One-time PINs offer better security, but potentially create greater workload for users. In this paper, we present an independent evaluation of a commercial system that makes PINs more resistant to observation attacks by using graphical passwords on a grid to generate a one-time PIN. 83 participants were asked to register with the system and log in at varying intervals. The successful login rate was approximately 91% after 3-4 days, and 97% after 9-10 days. Twenty five participants were retested after two years, and 27% of those were able to recall their pattern. We recorded 17 instances of failed attempts, and found that even though participants recalled the general shape of the pass-pattern in 13 of these instances, they could not recall its detailed location or sequence of cells. We conclude that GrIDsure is usable if people have one pass-pattern, but the level of security will depend on the context of use (it will work best in scenarios where repeated observations of transactions are unlikely), and the instructions given to users (without guidance, they are likely to chose from a small subset of the possible patterns which are easily guessed).

“Too Taxing on the Mind!” Authentication Grids are not for Everyone

“…GrIDsure is one such example, users are asked to memorise a pattern and then when authenticating they receive a grid filled with digits and need to enter the digits that correspond to their pattern. Brostoff, Inglesant and Sasse (2010) looked at the usability of GrIDsure and found that in nearly 18% of usages, participants were trying to enter the PIN on the grid directly instead of typing it. This undermines the security property offered by the grid, namely resistance to shoulder-surfing.…”

Pico in the Wild: Replacing Passwords, One Site at a Time

“…The mechanisms studied include graphical passwords [8], Passfaces [9] and grids (e.g. [10], [11]) to name a few. In reality, securityrelated actions are secondary tasks and a study has to mimic this set-up.…”

Make mine a quadruple: Strengthening the security of graphical one-time PIN authentication

“…GrIDsure has been found to be easy to learn and the recall of patterns is acceptably reliable; however, as with other password schemes, the effective pattern space is far smaller than the maximum possible [7]. However, to understand the actual pattern space, simple assumptions are not sufficient [6]; as well as the shape, the order of cells and placement on the grid are important factors distinguishing between patterns.…”

“…However, to understand the actual pattern space, simple assumptions are not sufficient [6]; as well as the shape, the order of cells and placement on the grid are important factors distinguishing between patterns. Although there are common patterns, these do not all occur with similar frequency [6], [7]. Brostoff et al have developed a taxonomy of patterns, and our current work builds on this.…”

“…Brostoff et al [7] found that users did indeed chose predictable patterns unless they were instructed to pick less predictable ones, and concluded that Bond's analysis affected security in some usage scenarios, but not others. They recommended its use as a second factor authentication where the capture of both one-time PIN and grid is unlikely such as at Point-of-Sale.…”