Exploring Effect of Location Number on Map-Based Graphical Password Authentication

Abstract

Abstract. Graphical passwords (GPs) that authenticate users using images are considered as one potential alternative to overcome the issues of traditional textual passwords. Based on the idea of utilizing an extremely large image, map-based GPs like PassMap and GeoPass have been developed, where users can select their secrets (geographical point) on a world map. In particular, PassMap allows users to select two locations on a map, while GeoPass reduces the location number to only one. At first glance, selecting one location is more vulnerable to attacks, while increasing the location number may add burden on users. In the literature, there is no research exploring this issue. Motivated by this, our purpose in this work is to explore the effect of location number between PassMap and GeoPass in terms of users' performance and feedback. In this work, we develop a generic and open platform for realizing map-based schemes, and conduct a user study with 60 participants, which reveals that selecting two locations would not degrade the scheme performance. Our effort aims to complement exiting research studies in this area.

SwipeVLock: A Supervised Unlocking Mechanism Based on Swipe Behavior on Smartphones

“…Graphical passwords have been researched over decades. There are three major types for a traditional GP scheme [4,29,42]: recognition-based scheme, pure recall-based scheme and cued recall-based scheme.…”

“…Then Thorpe et al [45] introduced GeoPass that only requires users to select one location. The previous study showed that there is no significant difference between the selection of one or two locations [29]. Meng [22] designed RouteMap, a map-based scheme that demands users to create a route on a world map.…”

“…In particular, we set the error tolerance to a 21 × 21 pixel box around the selected location. This selection is based on the previous work like [29,45]. For example, GeoPass [45] proved that an error tolerance of 21 × 21 pixel is usable in practice.…”

CPMap: Design of Click-Points Map-Based Graphical Password Authentication

“…GP Classification. Generally, a GP scheme can be categorized into three types [3,23,29]: namely, recognition-based (i.e., remembering and recognizing images), pure recall-based (i.e., recreating a pattern without a hint) and cued recall-based scheme (i.e., recreating a pattern with hints).…”

“…Intuitively, the selection of one location is more vulnerable to shoulder surfing attacks, while increasing the number of locations may cause more additional burden on users (i.e., selecting two places). Previous study [23] investigated this issue and found that increasing the number of locations from one to two would not much degrade the performance of users' memorability, but would indeed consume more authentication time.…”