Guidelines for designing graphical authentication mechanism interfaces

International Journal of Information and Computer Security

Volumn 3, Issue 1, 2009, Pages 60-85

  Renaud, K V ^a  

^a UNIVERSITY OF GLASGOW   (United Kingdom)

Author keywords

Design; Efficacy; Graphical authentication; Guidelines; Information and computer security; Pictures; Security

Indexed keywords

AUTHENTICATION; DESIGN; KNOWLEDGE BASED SYSTEMS; SECURITY SYSTEMS;

EFFICACY; GRAPHICAL AUTHENTICATIONS; GUIDELINES; INFORMATION AND COMPUTER SECURITY; PICTURES; SECURITY;

NETWORK SECURITY;

EID: 77955688017     PISSN: 17441765     EISSN: 17441773     Source Type: Journal    
DOI: 10.1504/IJICS.2009.026621     Document Type: Article

References (89)

1. Alvarez, G.A. and Cavanagh, P. (2004) 'The capacity of visual short-term memory is set both by visual information load and by number of objects', Psychological Science, Vol. 15, No. 2, pp.106-111.
2. Armitage, L. and Enser, P. (1997) 'Analysis of user need in image archives', Journal of Information Science, Vol. 24, No. 4, pp.287-299.
3. Bäckman, L., Nilsson, L-G. and Chalom, D. (1986) 'New evidence on the nature of the encoding of action events', Memory & Cognition, Vol. 14, No. 4, pp.339-346.
4. Bahrick, H.P., Bahrick, P.O. and Wittlinger, R.P. (1975) 'Fifty years of memory for names and faces: A cross-sectional approach', Journal of Experimental Psychology: General, Vol. 104, No. 1, pp.54-75.
5. Bentley, J. and Mallows, C. (2005) 'How much assurance does a PIN provide?', in H.S. Baird and D.P. Lopretsi (Eds.) Proceedings HIP. LNCS 3517, Bethlehem, PA: Springer Verlag, pp.111-126.
6. Blonder, G.E. (1996) Graphicalpassword, US Patent 5559961.
7. Brostoff, S. and Sasse, A. (2000) 'Are passfaces more usable than passwords? A field trial investigation', in S. McDonald (Ed.) People and Computers XIV - Usability or Else! Proceedings of HCI 2000, Springer, pp.405-424.
8. Brown, A.S., Bracken, E., Zoccoli, S. and Douglas, K. (2004) 'Generating and remembering passwords', Applied Cognitive Psychology, Vol. 18, No. 6, pp.641-651.
9. Bruce, V. (1983) 'Recognizing faces', Philosophical Transactions of the Royal Society of London, Series B, Biological Sciences, Vol. 302, No. 1110, pp.423-436.
10. Cave, C.B. (1997) 'Very long-lasting priming in picture naming', Psychological Science, Vol. 8, No. 4, pp.322-325.
11. Chalkias, K., Alexiadis, A. and Stephanides, G.A. (2006) 'Multi-grid graphical password scheme', Proceedings of the 6th International Conference on Artificial Intelligence and Digital Communications (AIDC Thessaloniki, Greece, pp.80-90.
12. Chiasson, S., Biddle, R. and van Oorschot, P.C. (2007a) 'A second look at the usability of click-based graphical passwords', Proceedings of the Second Symposium on Usable Privacy and Security SOUPS, Pittsburgh, USA.
13. Chiasson, S., van Oorschot, P.C. and Biddle, R. (2007b) 'Graphical password authentication using cued click points', in J. Biskup and J. Lopez (Eds.) ESORICS 2007. Published in LNCS 4734, pp.359-374.
14. Childers, I.L. and Houston, M.J. (1984) 'Conditions for a picture-superiority effect on consumer memory', Journal of Consumer Research, Vol. 11, pp.643-654.
15. Davenport, J.L. and Potter, M.C. (2004) 'Scene consistency in object and background perception', Psychological Science, Vol. 15, No. 8, pp.559-564.
16. Davis, D., Monrose, M. and Reiter, M. (2004) 'On user choice in graphical password schemes', 13thUSENIX Security Symposium, http://www.cs.jhu.edu/~fabian (accessed September 2006).
17. De Angeli, A., Coutts, M., Coventry, L. and Johnson, G.I. (2002) 'VIP: A visual approach to user authentication', Proceedings of the Working Conference on Advanced Visual Interfaces AVI, ACM Press, pp.316-323.
18. De Angeli, A., Coventry, L., Johnson, G. and Renaud, K. (2005) 'Is a picture really worth a thousand words? Reflecting on the usability of graphical authentication systems', International Journal of Human-Computer Studies, Special issue: HCI Research on Privacy and Security, Vol. 63, Nos. 1-2, pp.128-152.
19. Desimone, R., Albright, T.D., Gross, C.G. and Bruce, C. (1984) 'Stimulus-selective properties of inferior temporal neurons in the Macaque', Journal of Neuro Science, Vol. 4, No. 8, pp.2051-2062.
20. Dhamija, R. and Perrig, A. (2000) 'Deja vu: A user study using images for authentication', in Proceedings of USENIX Security Symposium, Denver, Colorado, pp.45-58.
21. Dirik, A.E., Memon, N. and Birget, J-C. (2007) 'Modeling user choice in the passpoints graphical password scheme', in SOUPS '07: Proceedings of the 3rd Symposium on Usable Privacy and Security, New York, NY: ACM, pp.20-28.
22. Dunphy, P. and Yan, J. (2007) 'Do background images improve draw a secret', Proceedings of the 14th ACM Conference on Computer and Communications Security, Alexandria, Virginia, USA, pp.36-47.
23. Durso, F.T. and Johnson, M.K. (1980) 'The effects of orienting tasks on recognition, recall and modality confusion of pictures and words', Journal of Verbal Learning and Verbal Behavior, Vol. 19, No. 4, pp.416-429.
24. Enns, J.T. and Rensink, R.A. (1991) 'Preattentive recovery of three-dimensional orientation from line drawings', Psychological Review, Vol. 98, No. 3, pp.335-351.
25. Farella, E., O'Modhrain, S., Benini, L. and Riccó, B. (2006) 'Gesture signature for ambient intelligence applications: A feasibility study', Pervasive Computing: 4th International Conference, PERVASIVE 2006. LNCS 3968, Dublin, Ireland, pp.288-304.
26. Furnell, S., Bryant, P. and Phippen, A.D. (2007) 'Assessing the security perceptions of personal internet users', Computers & Security, Vol. 26, pp.410-417.
27. Furnell, S., Papadopoulos, I. and Dowland, P. (2004) 'A long-term trial of alternative user authentication technologies', Information Management & Computer Security, Vol. 12, No. 2, pp.178-190.
28. Gaw, S. and Felten, E.W. (2006) 'Password management strategies for online accounts', SOUPS '06: Proceedings of the Second Symposium on Usable Privacy and Security, New York, NY: ACM Press, pp.44-55.
29. Gelinas, U.I., Jr., Gogan, J.L. and Wade, C. (2003) 'The U.S. treasury tests a new payment mechanism', Journal of Information Systems Education, Vol. 14, No. 3, pp.259-270.
30. Gibson, B.S. (2000) 'Searching for one versus two identical targets: when visual search has a memory', Psychological Science, Vol. 11, pp.324-327.
31. Gilchrist, I.D. and Harvey, M. (2000) 'Refixation frequency and memory mechanisms in visual search', Current Biology, Vol. 10, pp.1209-1212.
32. Harada, A., Isarida, T., Mizuno, T. and Nishigaki, M. (2006) 'A user authentication system using schema of visual memory', in A.J. Ijspeert (Ed.) BioADIT 2006. LNCS 3853, pp.338-345.
33. Hertzum, M. (2006) 'Minimal-feedback hints for remembering passwords', Interactions, May, Vol. 13, No. 3, pp.38-40.
34. Higbee, K.L. (1988) Your Memory: How It Works and How to Improve It 2nd ed., New York: Prentice-Hall Press.
35. Himmanem, S.A., Gentles, K. and Sailor, K. (2003) 'Rated familiarity, visual complexity and image agreement and their relation to naming difficulty for items from the Boston naming test', Journal of Clinical and Experimental Neuropsychology, Vol. 25, No. 8, pp.1178-1185.
36. Hiyashi, E. and Christin, N. (2008) 'Use your illusion: Secure authentication usable anywhere', Symposium on Usable Privacy and Security Systems. SOUPS, Pittsburgh, USA, 23-25 July, pp.35-45.
37. Hong, D., Man, S., Hawes, B. and Mathews, M. (2004) 'A password scheme strongly resistant to spyware', Proceedings of International Conference on Security and Management, Las Vegas, 21-24 June, pp.94-100.
38. Horowitz, T.S. and Wolfe, J.M. (1998) 'Visual search has no memory', Nature, Vol. 394, pp.575-577.
39. Irwin, D.E. and Zelinsky, G.J. (2002) 'Eye movements and scene perception: Memory for things observed', Perception and Psychophysics Vol. 64, No. 6, pp.882-895.
40. Jermyn, I., Mayer, A., Monrose, F., Reiter, M.K. and Rubin, A.D. (2000) 'The design and analysis of graphical passwords', Proceedings of the 9th USENIX Security Symposium, August, http://www.usenix.org/ publications/library/proceedings/sec2000/technical.html.
41. Johnson, C.J., Paivio, A. and Clark, J.M. (1996) 'Cognitive components of picture naming', Psychological Bulletin, Vol. 120, No. 1, pp.113-139.
42. Katre, D. (2004) 'Using mnemonic techniques as part of pictorial interface for self-identification of illiterate villagers', Proc I-HCI2004, Bangalore, India.
43. Kent, S.T. and Millett, L.I. (Eds.) (2003) Who Goes There Authentication Through the Eye of Privacy, Committee on Authentication Technologies and Their Privacy Implications, National Research Council of the National Academies, Washington, DC: National Academies Press.
44. Knopf, M., Mack, A., Lenel, A. and Ferrante, S. (2005) 'Memory for action events: Findings in neurological patients', Scandinavian Journal of Psychology, Vol. 46, pp.11-19.
45. Komanduri, S. (2007) 'Improving password usability with visual techniques', Masters thesis, Bowling Green State University, Bowling Green.
46. Lim, J-H., Tian, Q. and Mulhem, P. (2003) 'Home photo content modeling for personalized event-based retrieval', IEEE Multimedia, Vol. 10, No. 4, pp.28-37.
47. Madigan, S. (1983) 'Picture memory', in J. Yuille (Ed.) Imagery, Memory, and Cognition: Essays in Honor of Allan Paivio, Hillsdale, NJ: Lawrence Erlbaum Associates, pp.43-69.
48. Mandler, J.M. and Ritchey, G.H. (1977) 'Long-term memory for pictures', Journal Experimental Psychology Human Learning and Memory, Vol. 3, pp.386-396.
49. Maple, C. and Ryan, P. (2005) 'Safecracker: A visual password authentication scheme', in P. Isaas, P. Kommers and M. McPherson (Eds.) IADIS International Conference e-Society 2005, Qawra, Malta, pp.291-298.
50. Markkula, M. and Sormunen, E. (2000) 'End-user searching challenges indexing practices in the digital newspaper photo archive', Information Retrieval, Vol. 1, No. 4, pp.259-285.
51. Moncur, W. and Leplâtre, G. (2007) 'Pictures at the ATM: Exploring the usability of multiple graphical passwords', Proceedings CHI, San José, USA, 28 April-3 May, pp.887-894.
52. Moss, T. (2004) 'Web accessibility and UK law: Telling it like it is', http://www.alistapart.com/articles/accessuk (accessed October 2008).
53. Nelson, D.L. (1979) 'Remembering pictures and words: Appearance, significance and name', in L.S. Cernak and F.I.M. Craik (Eds.) Levels of Processing and Human Memory, Hillsdale, NJ: Erlbaum, pp.45-76.
54. Nyberg, L., Habib, R., McIntosh, A.R. and Tulving, E. (2000) 'Reactivation of encoding-related brain activity during memory retrieval', PNAS, Vol. 97, No. 20, pp.11120-11124.
55. Paivio, A. (1986) Mental Representations: A Dual Coding Approach, Oxford, UK: Oxford University Press.
56. Patel, S.N., Pierce, J.S. and Abowd, G.D. (2004) 'A gesture-based authentication scheme for untrusted public terminals', UIST '04: Proceedings of the 17th Annual ACM Symposium on User Interface Software and Technology, ACM Press, pp.157-160.
57. Pelizzon, L., Brandimote, M.A. and Favretto, A. (1999) 'Imagery and recognition: Dissociable measures of memory?', European Journal of Cognitive Psychology, Vol. 11, No. 3, pp.429-443.
58. Pering, T., Sundar, M., Light, J. and Want, R. (2003) 'Photographic authentication through untrusted terminals', Security & Privacy, Vol. 2, No. 1, pp.30-36.
59. Renaud, K. (2005) 'A visuo-biometric authentication mechanism for older users', Proc British HCI2005, Edinburgh, 5-9 September, pp.167-182.
60. Renaud, K. (2007) 'A process for supporting risk-aware web authentication mechanism choice', Reliability Engineering and System Safety, Special Edition, Vol. 92, No. 9, pp.1204-1217.
61. Renaud, K. (2008) 'On user involvement in production of images used in visual authentication', Journal of Visual Languages and Computing, to appear.
62. Renaud, K. and Olsen, E. (2007) 'Dynahand: Observation-resistant recognition-based web authentication', IEEE Technology and Society Special issue on Usable Security and Privacy, Vol. 26, No. 2, pp.22-31.
63. Renaud, K. and Ramsay, J. (2007) 'Now what was that password again? A more flexible way of identifying and authenticating our seniors', Behaviour and Information Technology, Special issue: Designing Computer Systems for and with Older Users, Vol. 26, No. 4, pp.309-322.
64. Renaud, K.V. and De Angeli, A. (2004) 'My password is here! Investigating authentication schemes based on visuo-spatial memory', Interacting with Computers, Vol. 16, No. 6, pp.1017-1041.
65. Rindfleisch, T.C. (1997) 'Privacy, information technology, and health care', Commun., ACM, Vol. 40, No. 8, pp.92-100.
66. Rodden, K. and Wood, K.R. (2003) 'How do people manage their digital photographs?', CHI '03: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, New York, NY: ACM Press, pp.409-416.
67. Roth, V., Richter, K. and Freidinger, R. (2004) 'A pin-entry method resilient against shoulder surfing', CCS '04: Proceedings of the 11th ACM Conference on Computer and Communications Security, ACM Press, pp.236-245.
68. Rousselet, G.A., Thorpe, S.J. and Faber-Thorpe, M. (2004) 'How parallel is visual processing in the ventral pathway?', TRENDS in Cognitive Science, Vol. 8, No. 8, pp.363-370.
69. Sasamoto, H., Christin, N. and Hayashi, E. (2008) 'Undercover: authentication usable in front of prying eyes', CHI '08: Proceeding of the Twenty-Sixth Annual SIGCHI Conference on Human Factors in Computing Systems, New York, NY: ACM, pp.183-192.
70. Sato, T.R., Watanabe, K., Thompson, K.G. and Schall, J.D. (2003) 'Effect of target-distractor similarity on FEF visual selection in the absence of the target', Experimental Brain Research, Vol. 151, pp.356-363.
71. Senkfor, A.J., Petten, C.V. and Kutas, M. (2002) 'Episodic action monitoring for real objects: An ERP investigation with perform, watch, and imagine action encoding tasks versus a non-action encoding task', Journal of Cognitive Neuroscience, Vol. 14, No. 3, pp.402-419.
72. Shepard, R.N. (1967) 'Recognition memory for words, sentences and pictures', Journal of Verbal Learning and Verbal Memory, Vol. 6, pp.156-163.
73. Standing, L. (1970) 'Learning 1000 pictures', Quarterly Journal of Experimental Psychology, Vol. 25, pp.207-222.
74. Guidelines for designing graphical authentication mechanism interfaces 85
75. Tari, F., Ozok, A.A. and Holden, S.H. (2006) 'A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords', Symposium on Usable Privacy and Security, Pittsburgh, pp.56-66.
76. Thorpe, J. and van Oorschot, P. (2004) 'Graphical dictionaries and the memorable space of graphical passwords', 13thUSENIX Security Symposium, pp.135-150.
77. Tullis, T.S. and Tedesco, D.P. (2005) 'Using personal photos as pictorial passwords', CHI2005, Portland, Oregon, USA, pp.1841-1844.
78. Urban, J. and Jose, J.M. (2006) 'EGO: A personalized multimedia management and retrieval tool', Int. J. Intell. Syst., Vol. 21, No. 7, pp.725-745.
79. Vecera, S.P. and Farah, M.J. (1994) 'Does visual attention select objects or locations?', Journal of Experimental Psychology: General Vol. 123, No. 2, pp.146-160.
80. Weinshall, D. (2006) 'Cognitive authentication schemes safe against spyware (short paper)', SP '06: Proceedings of the 2006 IEEE Symposium on Security and Privacy, IEEE Computer Society, Washington, DC, USA, pp.295-300.
81. Weinshall, D. and Kirkpatrick, S. (2004) 'Passwords you'll never forget, but can't recall', Proceedings of ACM CHI 2004 Conference on Human Factors in Computing Systems, Vol. 2 of Late Breaking Result Papers, pp.1399-1402.
82. Weldon, M.S. and Roediger, H.L. (1987) 'Altering retrieval demands reverses the picture superiority effect', Memory & Cognition, Vol. 15, No. 4, pp.269-280.
83. Wiedenbeck, S., Waters, J., Birget, J-C., Brodskiy, A. and Memon, N. (2005) 'Pass-points: Design and longitudinal evaluation of a graphical password system', Int. J. Hum.-Comput. Stud., Vol. 63, Nos. 1-2, pp.102-127.
84. Wiedenbeck, S., Waters, J., Sobrado, L. and Birget, J-C. (2006) 'Design and evaluation of a shoulder-surfing resistant graphical password scheme', AVI '06: Proceedings of the Working Conference on Advanced Visual Interfaces, New York, NY: ACM Press, pp.177-184.
85. Williams, L.G. (1966) 'The effect of target specification on objects fixated during visual search', Perception and Psychophysics, Vol. 1, pp.315-318.
86. Wolfe, J.M. (2003) 'Moving towards solutions to some enduring controversies in visual search', TRENDS in Cognitive Sciences, Vol. 7, No. 2, pp.70-76.
87. Wood, C.C. (1997) 'Policies alone do not constitute a sufficient awareness effort', Computer Fraud & Security, No. 12, pp.14-19.
88. Yamane, S., Kaji, S. and Kawano, K. (1988) 'What facial features activate face neurons in the interferotemporal cortex of the monkey', Experimental Brain Research, Vol. 73, No. 1, pp.209-214.
89. Zimmer, H.D. (2001) 'Why do actions speak louder than words? Action memory as a variant of encoding manipulations or the result of a special memory system?', in H.D. Zimmer, R.L. Cohen, M. Guynn, J. Engelkamp, R. Kormi-Nouri and M.N. Foley (Eds.) Memory for Action: A Distinct Form of Episodic Memory?, New York: Oxford University Press, pp.151-197.