GTmoPass

Abstract

As public displays continue to deliver increasingly private and personalized content, there is a need to ensure that only the legitimate users can access private information in sensitive contexts. While public displays can adopt similar authentication concepts like those used on public terminals (e.g., ATMs), authentication in public is subject to a number of risks. Namely, adversaries can uncover a user's password through (1) shoulder surfing, (2) thermal attacks, or (3) smudge attacks. To address this problem we propose GTmoPass, an authentication architecture that enables Multi-factor user authentication on public displays. The first factor is a knowledge-factor: we employ a shoulder-surfing resilient multimodal scheme that combines gaze and touch input for password entry. The second factor is a possession-factor: users utilize their personal mobile devices, on which they enter the password. Credentials are securely transmitted to a server via Bluetooth beacons. We describe the implementation of GTmoPass and report on an evaluation of its usability and security, which shows that although authentication using GTmoPass is slightly slower than traditional methods, it protects against the three aforementioned threats.

Understanding Face and Eye Visibility in Front-Facing Cameras of Smartphones used in the Wild

“…In addition to gaze estimation for monitoring purposes, several works proposed interacting with smartphones using gaze. For example, previous work investigated eye gesture detection on unmodified tablets [18,28,36,43,51], and multiple authentication schemes used gaze gestures detected from the front-facing camera [29,30,31].…”

GazeTouchPIN: protecting sensitive data on mobile devices using secure multimodal authentication

“…There is a need for a wide range of authentication mechanisms to fit different user preferences, tasks and contexts. Meanwhile, advances in remote gaze estimation enable eye tracking [11,27] and gaze gestures detection [12,13,22,28] using the front-facing cameras of unmodified mobile devices. These advances enable systems to use gaze for mobile authentication [12,13,16,20].…”

Which one is me?

“…Gaze-enabled public displays have also started to support multiple users [12,16,38]. Other displays allow interaction via mobile devices [14,18,32].…”