Exploiting predictability in click-based graphical passwords

Journal of Computer Security

Volumn 19, Issue 4, 2011, Pages 699-702

  Van Oorschot, P C ^a   Thorpe, Julie ^b  

^a CARLETON UNIVERSITY   (Canada)

^b UNIVERSITY OF ONTARIO INSTITUTE OF TECHNOLOGY   (Canada)

Author keywords

click order patterns; dictionary attack; empirical studies; Graphical passwords; hot spots; human computation; human seeded attacks; PassPoints; password guessing; passwords; user choice

Indexed keywords

CLICK-ORDER PATTERNS; DICTIONARY ATTACK; EMPIRICAL STUDIES; GRAPHICAL PASSWORD; HOT SPOT; HUMAN COMPUTATION; HUMAN-SEEDED ATTACKS; PASS POINT; PASSWORD GUESSING; PASSWORDS; USER CHOICE;

MARKOV PROCESSES; ONLINE SYSTEMS;

COMPUTER CRIME;

EID: 78751535295     PISSN: 0926227X     EISSN: None     Source Type: Journal    
DOI: 10.3233/JCS-2010-0411     Document Type: Article

References (47)

1. J.C. Birget, D. Hong and N. Memon, Robust discretization, with an application to graphical passwords, IEEE Transactions on Information Forensics and Security 1 (2006), 395-399.
2. G. Blonder, Graphical passwords, United States Patent 5559961, 1996.
3. P. Bourke, Determining whether or not a polygon (2D) has its vertices ordered clockwise or counterclockwise, 1998, available at: http://local.wasp. uwa.edu.au/~pbourke/geometry/clockwise/ index.html.
4. I. Britton (Reproduced by permission of), Image ref: 21-35-3, available at: http://www.freefoto. com.
5. S. Chiasson, A. Forget, R. Biddle and P.C. van Oorschot, Influencing users towards better passwords: Persuasive cued click-points, in: Proceedings of HCI, Liverpool, England, 2008.
6. S. Chiasson, A. Forget, R. Biddle and P.C. van Oorschot, User interface design affects security: Patterns in click-based graphical passwords, International Journal of Information Security 8(6) (2009), 387-398.
7. S. Chiasson, J. Srinivasan, P.C. van Oorschot and R. Biddle, Centered discretization with application to graphical passwords, in: Proceedings of the First USENIX Workshop on Usability, Psychology, and Security (UPSEC), San Francisco, CA, USA, 2008.
8. S. Chiasson, P.C. van Oorschot and R. Biddle, A second look at the usability of click-based graphical passwords, in: Proceedings of the 3rd Symposium on Usable Privacy and Security (SOUPS), Pittsburgh, PA, USA, 2007.
9. S. Chiasson, P.C. van Oorschot and R. Biddle, Graphical password authentication using cued click points, in: Proceedings of the European Symposium on Research in Computer Security (ESORICS), Dresden, Germany, 2007.
10. N. Cowan, The magical number 4 in short-term memory: A reconsideration of mental storage capacity, Behavioral and Brain Sciences 24 (2000), 87-185.
11. D. Davis, F. Monrose and M.K. Reiter, On user choice in graphical password schemes, in: Proceedings of the 13th USENIX Security Symposium, San Diego, CA, USA, 2004.
12. J.L. Devore, Probability and Statistics for Engineering and the Sciences, 4th edn, Brooks/Cole, Pacific Grove, CA, USA, 1995.
13. A. Dirik, N. Memon and J.-C. Birget, Modeling user choice in the passpoints graphical password scheme, in: 3rd Symposium on Usable Privacy and Security (SOUPS), Pittsburgh, PA, USA, 2007.
14. P.F. Felzenszwalb and D.P. Huttenlocher, Efficient graph-based image segmentation, International Journal of Computer Vision 59(2) (2004), 167-181, code available at: http://people.cs.uchicago.edu/~pff/segment/.
15. FreeImages.com (Photograph Courtesy of), Image ID: wm-asian-places-047, available at: http:// www.freeimages.com.
16. FreeImages.com (Photograph Courtesy of), Image ID: wm-recreation-005, available at: http:// www.freeimages.com.
17. Freeimages.co.uk (Photograph Courtesy of), Image ID: paperclips.jpg, available at: http:// www.freeimages.co.uk.
18. Freeimages.co.uk (Photograph Courtesy of), Image ID: pcb04090023.jpg, available at: http:// www.freeimages.co.uk.
19. C.G. Harris and M.J. Stephens, A combined corner and edge detector, in: Proceedings of the Fourth Alvey Vision Conference, University of Manchester, UK, 1988, pp. 147-151.
20. T. Hawk (Photograph Courtesy of), Flickr photo download: Where I've been lately, available at: http://www.flickr.com/photo-zoom.gne?id=96968793&size= o.
21. L. Itti, C. Koch and E. Niebur, A model of saliency-based visual attention for rapid scene analysis, IEEE Transactions on Pattern Analysis and Machine Intelligence 20(11) (1998), 1254-1259.
22. W. Jansen, S. Gavrilla, V. Korolev, R. Ayers and R. Swanstrom, Picture password: A visual login technique for mobile devices, NIST Report - NISTIR7030, 2003.
23. I. Jermyn, A. Mayer, F. Monrose, M. Reiter and A. Rubin, The design and analysis of graphical passwords, in: Proceedings of the 8th USENIX Security Symposium, Washington, DC, USA, 1999.
24. R. Kohavi, A study of cross-validation and bootstrap for accuracy estimation and model selection, in: Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), Montreal, QC, Canada, 1995.
25. S.J. Luck and E.K Vogel, The capacity of visual working memory for features and conjunctions, Nature 390 (1997), 279-281.
26. S. Madigan, Picture memory, in: Imagery, Memory and Cognition, J.C. Yuille, ed., Lawrence Erlbaum Associates, Mahwah, NJ, USA, 1983, pp. 65-89.
27. J.L. Massey, Guessing and entropy, in: ISIT: Proceedings IEEE International Symposium on Information Theory, Trondheim, Norway, 1994, p. 204.
28. F. Monrose and M.K. Reiter, Graphical passwords, in: Security and Usability, L. Cranor and S. Garfinkel, eds, O'Reilly, Sebastopol, CA, 2005, pp. 147-164, Chapter 9.
29. A. Narayanan and V. Shmatikov, Fast dictionary attacks on passwords using time-space tradeoff, in: Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, USA, 2005, pp. 364-372.
30. Passlogix, available at: http://www.passlogix.com, site accessed February 2, 2007.
31. M. Peters, B. Laeng, K. Latham, M. Jackson, R. Zaiyouna and C. Richardson, A redrawn Vandenberg and Kuse mental rotations test: Different versions and factors that affect performance, Brain and Cognition 28 (1995), 39-58.
32. Photobucket.com (Photograph Courtesy of), Image ID: 11-12-1-web, available at: http://i26. photobucket.com/albums/c136/hamm239/11-12-1-web.jpg.
33. Real User Corporation, About passfaces, available at: http://www.realuser.com, site accessed 24 May 2004.
34. S. Riley, What users know and what they actually do, Usability News 8(1) (2006), available at: http://psychology.wichita.edu/surl/usabilitynews/81/ Passwords.htm.
35. A. Salehi-Abari, J. Thorpe and P.C. van Oorschot, On purely automated attacks and click-based graphical passwords, in: Proceedings of the 24th Annual Computer Security Applications Conference (ACSAC), Anaheim, CA, USA, 2008.
36. SFR IT-Engineering, The grafical login solution for your pocket PC - visKey, available at: http:// www.sfr-software.de/cms/EN/pocketpc/viskey/index. html, site accessed 18 March 2007.
37. Siracusa (Reproduced by Permission of), John, Clutter: About 130 Windows, available at: http:// arstechnica.com/reviews/os/macosx-10.3.ars/5.
38. X. Suo, Y. Zhu and G. Scott Owen, Graphical passwords: A survey, in: Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC), Tucson, AZ, USA, 2005.
39. J. Thorpe (Personal Photograph by), Bee in garden, 2006.
40. J. Thorpe, On the predictability and security of user choice in passwords, PhD thesis, Carleton University, January 2008.
41. J. Thorpe and P.C. van Oorschot, Human-seeded attacks and exploiting hot spots in graphical passwords, in: Proceedings of the 16th USENIX Security Symposium, Boston, MA, USA, 2007.
42. P.C. van Oorschot, A. Salehi-Abari and J. Thorpe, Purely automated attacks on PassPoints-style graphical passwords, IEEE Transactions on Information Forensics and Security (TIFS) 5(3) (2010), 393-405.
43. P.C. van Oorschot and J. Thorpe, On predictive models and user-drawn graphical passwords, ACM Transactions on Information and System Security 10(4) (2007), 1-33.
44. L. von Ahn, R. Liu and M. Blum, Peekaboom: A game for locating objects in images, in: Conference on Human Factors in Computing Systems (CHI), Montreal, QC, Canada, 2006.
45. S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy and N. Memon, Authentication using graphical passwords: Basic results, in: Human-Computer Interaction International (HCII), Las Vegas, NV, USA, 2005.
46. S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy and N. Memon, Authentication using graphical passwords: Effects of tolerance and image choice, in: Proceedings of the 1st Symposium on Usable Privacy and Security (SOUPS), Pittsburgh, PA, USA, 2005.
47. S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy and N. Memon, PassPoints: Design and longitudinal evaluation of a graphical password system, International Journal of Human-Computer Studies 63 (2005), 102-127; Special Issue on HCI Research in Privacy and Security.