On predictive models and user-drawn graphical passwords

ACM Transactions on Information and System Security

Volumn 10, Issue 4, 2008, Pages

  Oorschot, P C Van ^a   Thorpe, Julie ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

Dictionary attack; Draw a Secret; Graphical dictionary; Graphical passwords; Memorable passwords; Modeling user choice; Password complexity factors

Indexed keywords

DICTIONARY ATTACKS; DRAW-A-SECRET; GRAPHICAL PASSWORDS; MEMORABLE PASSWORDS; MODELING USER CHOICE; PASSWORD COMPLEXITY FACTORS; VISUAL RECALLS;

COGNITIVE SYSTEMS; COMPUTER CRIME; COMPUTER PRIVACY; COMPUTER SIMULATION; GLOSSARIES; GRAPHICAL USER INTERFACES;

CODES (SYMBOLS);

EID: 39149106769     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/1284680.1284685     Document Type: Article

References (48)

1. ATTNEAVE, F. 1955. Symmetry, information and memory for patterns. American Journal of Psychology 68, 209-222.
2. ATTNEAVE, F. 1957. Physical determinants of the judged complexity of shapes. Journal of Experimental Psychology 53, 4, 221-227.
3. BIRGET, J. C., HONG, D., and MEMON, N. 2003. Graphical passwords based on robust discretization. IEEE Transactions on Information Forensics and Security 1, 3 (Sept.), 395-399. Cryptology ePrint Archive, Report 2003/168. http://eprint.iacr.org/, site accessed Jan. 12, 2004.
4. BLONDER, G. 1996. Graphical passwords. United States Patent 5559961.
5. BOWER, G. H., KARLIN, M. B., AND DUECK, A. 1975. Comprehension and memory for pictures. Memory and Cognition 3, 216-220.
6. CALKINS, M. 1898. Short studies in memory and association from the wellesley college laboratory. Psychological Review 5, 451-462.
7. DAEMEN, J., GOVAERTS, R., AND VANDEWALLE, J. 1993. Weak keys for IDEA. In Proceedings of the 13th Annual International Cryptology Conference on Advances in Cryptology. Lecture Notes In Computer Science; Vol. 773, 224-231.
8. DAVIS, D., MONROSE, F., AND REITER, M. 2004. On user choice in graphical password schemes. In 13th USENIX Security Symposium.
9. DHAMLIA, R. AND PERRIG, A. 2000. Déjà vu: A user study using images for authentication. In 9th USENIX Security Symposium.
10. FRENCH, R.-S. 1954. Identification of dot patterns from memory as a function of complexity. Journal of Experimental Psychology 47, 22-26.
11. GOLDBERG, J., HAGMAN, J., AND SAZAWAL, V. 2002. Doodling our way to better authentication. In Conference on Human Factors and Computing Systems (April 20-25). ACM Press, New York. 868-869. CHI '02 extended abstracts on Human Factors in Computer Systems.
12. HALDERMAN, J. A., WATERS, B., AND FELTEN, E. W. 2005. A convenient method for securely managing passwords. In Proceedings of the 14th International World Wide Web Conference. ACM Press, New York. 471-479.
13. ICHIKAWA, S.-I. 1982. Measurement of visual memory span by means of the recall of dot-in-matrix patterns. Behavior Research Methods and Instrumentation 14, 3, 309-313.
14. JANSEN, W., GAVRILLA, S., KOROLEV, V., AYERS, R., AND R., S. 2003. Picture password: A visual login technique for mobile devices. NIST Report - NISTIR7030.
15. JERMYN, I., MAYER, A., MONROSE, F., REITER, M., AND RUBIN, A. 1999. The design and analysis of graphical passwords. In 8th USENIX Security Symposium.
16. KIRKPATRICK, E. A. 1894. An experimental study of memory. Psychological Review 1, 602-609.
17. KLEIN, D. 1990. Foiling the cracker: A survey of, and improvements to, password security. In The 2nd USENIX Security Workshop. 5-14.
18. KUO, C., ROMANOSKY, S., AND CRANOR, L. 2006. Human selection of mnemonic phrase-based passwords. In 2nd Symp. Usable Privacy and Security (SOUPS). ACM Press, New York. 67-78.
19. MADIGAN, S. 1983. Picture Memory. In Imagery, Memory and Cognition, J. C. Yuille, Ed. Lawrence Erlbaum, Mahwah, NJ. 65-89.
20. MADIGAN, S. AND LAWRENCE, V. 1980. Factors affecting item recovery and hypermnesia in free recall. American Journal of Psychology 93, 489-504.
21. MASSEY, J. 1994. Guessing and entropy. In ISIT: Proceedings IEEE International Symposium on Information Theory. 204.
22. MENEZES, A. J., VAN OORSCHOT, P. C., AND VANSTONE, S. A. 1996. Handbook of Applied Cryptography. CRC Press, Boca Raton, FL. 290-291. Note 8.8.
23. MONROSE, F. 1999. Towards Stronger User Authentication. Ph.D. thesis, NY University.
24. MONROSE, F. AND REITER, M. K. 2005. Graphical passwords. In Security and Usability, L. Cranor and S. Garfinkel, Eds. O'Reilly Media Inc., Sebastopol, CA, Chapter 9, 147-164.
25. MUFFETT, A. 2004. Crack password cracker. http://ciac.llnl.gov/ ciac/ToolsUnixAuth.html, site accessed Jan. 12, 2004.
26. NAKAJIMA, J. AND MATSUI, M. 2002. Performance analysis and parallel implementation of dedicated hash functions. In Advances in Cryptology - Proceedings of EUROCRYPT 2002. 165-180.
27. NALI, D. AND THORPE, J. 2004. Analyzing User Choice in Graphical Passwords. Tech. Report TR-04-01, School of Computer Science, Carleton University, Canada, http://www.scs.carleton.ca/research/ tech_reports/2004/TR-04-01.pdf.
28. OPENWALL PROJECT. 2004a. John the Ripper password cracker, http://www.openwall.com/john/, site accessed Jan.7, 2004.
29. OPENWALL PROJECT. 2004b. Wordlists. http://www.openwall.com/passwords/wordlists/, site accessed Jan.7 2004.
30. PERKINS, F. 1932. Symmetry in visual recall. American Journal of Psychology 44, 473-490.
31. PERRIG, A. AND SONG, D. 1999. Hash visualization: A new technique to improve real-world security. In International Workshop on Cryptographic Techniques and E-Commerce. 131-138.
32. PINKAS, B. AND SANDER, T. 2002. Securing passwords against dictionary attacks. In 9th ACM Conference on Computer and Communications Security. ACM Press, New York. 161-170.
33. PROVOS, N. AND MAZIERES, D. 1999. A future-adaptable password scheme. In Proceedings of the USENIX Annual Technical Conference.
34. REAL USER CORPORATION. 2004. About passfaces. http://www.realuser.eom/cgi-bin/ru.exe/_/homepages/technology/passface.htm, site accessed May 25, 2004.
35. SHANNON, C. 1948. A mathematical theory of communication. The Bell System Technical Journal 27, 379-423.
36. SPAFFORD, E. 1989. Crisis and aftermath (The Internet worm). Comm. of the ACM 32(6), 678-687.
37. SPAFFORD, E. H. 1992. OPUS: Preventing weak password choices. Comput. Secur. 11, 3, 273-278.
38. SUO, X., ZHU, Y., AND OWEN, G. S. 2005. Graphical passwords: A survey. In 21st Annual Computer Security Applications Conference (ACSAC) (Dec. 5-9).
39. TAO, H. 2006. Pass-Go, a New Graphical Password Scheme. M.S. thesis, School of Information Technology and Engineering, University of Ottawa, Canada.
40. THORPE, J. AND VAN OORSCHOT, P. 2004a. Graphical dictionaries and the memorable space of graphical passwords. In 13th USENIX Security Symposium (Aug. 9-13).
41. THORPE, J. AND VAN OORSCHOT, P. 2004b. Towards secure design choices for implementing graphical passwords. In 20th Annual Computer Security Applications Conference (ACSAC 2004) (Dec. 6-10). IEEE, Los Alamitos, CA.
42. THORPE, J. AND VAN OORSCHOT, P. 2005. On the Security of Graphical Password Schemes (Extended Version). Tech. Report TR-05-11, School of Computer Science, Carleton University, Canada, http://www.scs.carleton.ca/researcli/tech_reports/2005/download/TR-05-11.pdf.
43. TYLER, C. 1996. Human symmetry perception. In Human Symmetry Perception and Its Computational Analysis, C. Tyler, Ed. VSP, The Netherlands. 3-22.
44. VAN OORSCHOT, P. C. AND STUBBLEBINE, S. 2006. On countering online dictionary attacks with login histories and humans-in-the-loop. ACM TISSEC 9, 3 (Aug.), 235-258.
45. VOGEL, E. K. AND MACHIZAWA, M. G. 2004. Neural activity predicts individual differences in visual working memory capacity. Nature (London) 428, 748-751.
46. WAGEMANS, J. 1996. Detection of Visual Symmetries. In Human Symmetry Perception and its Computational Analysis, C. Tyler, Ed. VSP, The Netherlands, 25-48.
47. WIEDENBECK, S., WATERS, J., BIRGET, J., BRODSKIY, A., AND MEMON, N. 2005. PassPoints: Design and longitudinal evaluation of a graphical password system. International J. of Human-Computer Studies (Special Issue on HCI Research in Privacy and Security) 63, 102-127.
48. YAN, J. 2001. A Note on Proactive Password Checking. ACM New Security Paradigms Workshop, New Mexico.