A Human-Cognitive Perspective of Users’ Password Choices in Recognition-Based Graphical Authentication

텍스트 기반 패스워드 인증의 문제점을 해결하기 위해서 이미지를 사용하는 그래픽 패스워드가 발전 하였다. 기본적으로 그래픽 패스워드는 화면에 보이는 이미지 위의 정확한 점의 위치를 순서대로 선택(클릭)하여 인증을 처리하는 방식이다. 이러한 기존의 그래픽 패스워드 방식은 화면상의 정확한 지점을 선택하여 클릭하지 못하면 인식에 실패한다. 본 논문에서는 이러한 단점을 개선한 신 개념의 그래픽 패스워드 방식인 PassPositions를 소개한다. PassPositions는 지금까지의 그래픽 패스워드 방식에서 사용하지 않았던 상대위치를 패스워드 생성에 사용한 신개념의 그래픽 패스워드 기법이다. PassPositions는 유니버설 디자인에 기반을 둔 그래픽 패스워드 기법으로 사용자의 신체적 조건에 관계없이 모두가 편리하게 사용할 수 있다. Graphical passwords using images have been developed to solve problems in text based password recognition. The basic recognition process scheme of graphical passwords is clicking certain points on the screen image in correct order. In this pre-developed method of graphical passwords the recognition will fail if the precise positions are not clicked. A new graphical password system called PassPositions is introduced in this paper. PassPositions is a new graphical password scheme which is using relative positions never used earlier graphical password schemes. PassPositions is a graphical password scheme based on universal design that everybody can use conveniently without regarding their physical conditions.

Traditional text based password schemes are subjected to dictionary attacks on a very large scale. As a solution, graphical password schemes are a promising alternative to text-based recognition schemes where instead of text, images are chosen for a password. However, these schemes are again affected due to shoulder surfing and less effective due to large dictionary space. This paper focuses on providing a solution based on text-based graphical password techniques, a combination of Déjà vu and Moveable Frame scheme. Déjà vu is further replaced by text-based images than purely graphics. Our research has two main objectives: 1) To thwart shoulder surfing 2) To minimize the search time of pass images on the login screen. The project was implemented as a resulting android application using Android Studio. Results show the proposed scheme of graphical password system with multiple alphabet images is more recognizable and has less cognitive load on user as compared to image based graphical password schemes. The incorrect login rate for multiple alphabet based images with movable frame was 15% more than graphical password schemes thus a better solution to protect shoulder surfing.

Graphical passwords are an alternative form of authentication that use images for login, and leverage the picture superiority effect for good usability and memorability. Categories of graphical passwords have been distinguished on the basis of different kinds of memory retrieval (recall, cued-recall, and recognition). Psychological research suggests that leveraging recognition memory should be best, but this remains an open question in the password literature. This paper examines how different kinds of memory retrieval affect the memorability and usability of random assigned graphical passwords. A series of five studies of graphical and text passwords showed that participants were able to better remember recognition-based graphical passwords, but their usability was limited by slow login times. A graphical password scheme that leveraged recognition and recall memory was most successful at combining memorability and usability.

Shoulder surfing is an easy attack, where an unauthorized user tries to gain access to sensitive information. Unfortunately, none of the currently available content-based shoulder-surfing approaches for protected graphical concealed keywords are both trustworthy and professional. This paper proposes an authentication technique that operates on touchscreen devices with an aim to solve the problem of shoulder-surfing assaults over validation. Graphical passwords are required to get access to the system and to assist with its security. A graphical password is a type of password that can be used instead of a textual password to gain access to a system. It is safer than a written password, which is vulnerable to a shoulder-surfing assault. In this study, we used a falsification technique to create a system that is immune to shoulder-surfing assaults. As a result, the hacker will be perplexed when attempting to obtain and misuse the password. Using Android Studio, the proposed scheme was developed into an android application composed of shoulder-surfing resistant user registration and login process. When compared with other graphical password techniques based on images, the proposed the technique of graphical authentication mechanism with numbers/digits is more easy to memorize and has less cognitive strain on the user. Our graphical authentication technique has more complexity and larger password space than the conventional numeric password schemes, making it a superior method for safeguarding against shoulder surfing attacks. To meet customer expectations, this project seeks to design a graphical password by combining processes such as long key press, and acceleration detection mechanism of Android devices.

In this paper, we discuss how to prevent users' passwords from being stolen by adversaries. Textual-based password authentication scheme tend to be more vulnerable to attacks such as shoulder surfing. To overcome the vulnerabilities of traditional methods, visual or graphical password schemes have been developed as possible alternative solutions to text-based scheme. But simply adopting graphical password authentication also has some drawbacks; hence some hybrid schemes based on text as well as graphics were developed. We propose a virtual password concept involving a small amount of human computing to secure users' passwords in on-line environments. We also analyze how the proposed scheme defends against phishing, key logger, shoulder-surfing, man in the middle and session hijacking attacks.

Graphical user authentication (GUA) is a common alternative to text-based user authentication, where people are required to draw graphical passwords on background images. Recent research provides evidence that gamification of the graphical password creation process influences people to make less predictable choices. Aiming to understand the underlying reasons from a visual behavior perspective, in this paper, we report a small-scale eye-tracking study that compares the visual behavior developed by people who follow a gamified approach and people who follow a non-gamified approach to make their graphical password choices. The results show that people who follow a gamified approach have higher gaze-based entropy, as they fixate on more image areas and for longer periods, and thus, they have an increased effective password space, which could lead to better and less predictable password choices.

Graphical passwords are considered to be a secure and memorable alternative to text passwords. Users of such systems, authenticate themselves by identifying a subset of images from the set of displayed images. However, despite the impressive results of user studies on experimental graphical passwords schemes, their overall commercial adaptations have been relatively low. In this paper, we investigate the reasons behind the low commercial acceptance of graphical passwords and present recommendations to overcome the same. Based on these recommendations, we design a simple graphical password scheme, which we call as NAPTune. NAPTune is aimed to work as a cued recognition based graphical authentication scheme that allows users to choose both text as well as images as their password with the same underlying design and interaction. In doing so, we blend the strengths of Numbers, Alphabets and Pictures (NAP) together to effectively defeat prevalent forms of social hacking. We conducted a user study with 35 participants to evaluate the viability of our proposed design. Results of the study are encouraging which indicates that our proposed design is potentially secure and usable method of authentication.

An alternative authentication method to traditional alphanumeric passwords is graphical password authentication, also known as graphical authentication, for which one of the most valuable cued-recall techniques is PassPoints. This technique stands out for its security and usability. However, it can be violated if the user follows a predefined pattern when selecting the five points in an image as their passwords, such as the DIAG and LINE patterns. Dictionary attacks can be built using these two patterns to compromise graphical passwords. So far, no reports have been found in the state of the art about any test capable of detecting graphical passwords with DIAG or LINE patterns in PassPoints. Studies carried out in other scenarios have shown the effectiveness of the characteristics of Delaunay triangulations in extracting information about the dependence between the points. In this work, graphical passwords formed by five randomly selected points on an image are compared with passwords whose points contain patterns of the DIAG or LINE type. The comparison is based on building for each password its Delaunay triangulation and calculating the mean value of the maximum angles of the triangles obtained; such a mean value is denoted by amadt. It is experimentally shown that in passwords containing DIAG and LINE patterns, the value of amadt is higher than the one obtained in passwords formed by random dots. From this result, it is proposed to use this amadt value as a statistic to build a test of means. This result constitutes the work’s main contribution: The proposal of a spatial randomness test to detect weak graphic passwords that contain DIAG and LINE type patterns. The importance and novelty of this result become evident when two aspects are taken into account: First, these weak passwords can be exploited by attackers to improve the effectiveness of their attacks; second, there are no prior criteria to detect this type of weak password. The practical application of said test contributes to increasing PassPoints security without substantially affecting its efficiency.

PassBYOP is a new graphical password scheme for public terminals that replaces the static digital images typically used in graphical password systems with personalized physical tokens, herein in the form of digital pictures displayed on a physical user-owned device such as a mobile phone. Users present these images to a system camera and then enter their password as a sequence of selections on live video of the token. Highly distinctive optical features are extracted from these selections and used as the password. We present three feasibility studies of PassBYOP examining its reliability, usability, and security against observation. The reliability study shows that image-feature based passwords are viable and suggests appropriate system thresholds—password items should contain a minimum of seven features, 40% of which must geometrically match originals stored on an authentication server in order to be judged equivalent. The usability study measures task completion times and error rates, revealing these to be 7.5 s and 9%, broadly comparable with prior graphical password systems that use static digital images. Finally, the security study highlights PassBYOP's resistance to observation attack—three attackers are unable to compromise a password using shoulder surfing, camera-based observation, or malware. These results indicate that PassBYOP shows promise for security while maintaining the usability of current graphical password schemes.

Adaptive user authentication policies are moving in the center of attention lately aiming to assist users in creating memorable and secure passwords. Focusing on graphical user authentication, state-of-the-art research has provided evidence that image-related attributes affect password memorability and security. Nonetheless, the effects of users' contemporary cultural-related memories towards password memorability and security have not been investigated so far, although it is known that user authentication is a cross-cultural task. Aiming to shed light on whether such effects exist, we conducted a study in which users created a graphical password with a contemporary culture-intensive vs. a culture-neutral image. Results indicate that image content related to one's cultural-related memories affects the interaction behavior during password composition, and consequently password memorability. Findings point towards a promising new direction for considering human contemporary cultural memories in the design of adaptive password policies to increase memorability and preserve security.

Graphical passwords or passphrases (GPs) are examined as reliable authentication system over text-based passphrases. Several obtainable applications utilize GPs and image-based authentication schemes. Even though, these authentication methods experience an issue of managing image or pictorial data. Here, Natural Language Processing (NLP)+Stable Diffusion (SD)_graphical authentication is presented for graphical authentication using passphrase. The passphrase, removing stop words, spell check, similarity check, stemming and lemmatization, label encoder, positional embedding and encryption are the steps carried out in registration phase whereas decryption Advanced Encryption Standard (AES), sentence generation, image set generation and grid module are conducted in verification phase. Initially, passphrase is considered and then, stop words are removed from it. Thereafter, spell check as well as similarity check are done and after these processes stemming and lemmatization is performed. In label encoder, label is generated for individual word in passphrase. Afterwards, positional embedding is done and lastly, encryption is conducted in registration phase. In verification phase, encrypted passphrase is decrypted, sentence is generated utilizing Generative Pre-trained Transformer (GPT), image set is generated by SD model and finally, image grid module is accomplished. Moreover, NLP+SD_graphical authentication achieved minimum attack detection, login failure, login time about 0.598, 0.191, 14.175sec and maximum memorability about 0.932.

Since conventional password schemes are vulnerable to shoulder surfing, many shoulder surfing resistant graphical password schemes have been proposed. However, as most users are more familiar with textual passwords than pure graphical passwords, text-based graphical password schemes have been proposed. Unfortunately, none of existing text-based shoulder surfing resistant graphical password schemes is both secure and efficient enough. In this paper, we propose an improved text-based shoulder surfing resistant graphical password scheme by using colors. In the proposed scheme, the user can easily and efficiently login system. Next, we analyze the security and usability of the proposed scheme, and show the resistance of the proposed scheme to shoulder surfing and accidental login.

People tend to develop different cognitive styles, which influence how we process information when interacting with computer systems. Field Dependence-Independence is one of the most well-known cognitive styles that influences how we process information in visual search tasks. Considering that such tasks are common in video games, this paper investigates whether information processing differences, derived from Field Dependence-Independence cognitive style, reflect on different eye trajectories when playing a visual search game. We performed a small-scale eye-tracking study to investigate it. The results of the scanpath analysis indicated that such differences exist. The study results provide a first step towards understanding how people who share different cognitive styles differ in the scanpaths they develop when playing a visual search game.

The paper is devoted to the interplay issues between ontology engineering and cognitive psychology. It describes the study targeted at new visual structuring paradigm of ontology development. Such approach is formed with regard to personal cognitive features. The research was performed within the KOMET (knowledge and content structuring via methods of collaborative ontology design) project. Two phases of research have been done within the project. First was devoted to study of correlations between the expert's personal cognitive style features and the peculiarities of expert's subject domain ontology development procedure. The second deals with research on the relationship between the expert's individual cognitive style and the collective ontology design (including the design performed in groups consisting of experts either of similar or of different cognitive styles). The results of this research project can be applied to organising the collaborative ontology design, data and content structuring and other group analytical work.

Previous research documents variation among auditors in terms of their cognitive style. Auditors have been classified as possessing an intuitive, analytic, or hybrid cognitive style. However, the potential implications of cognitive style upon auditor task performance have received little attention. Building upon the work of Chan (1996), this paper examines the role of “cognitive misfit” on auditor task performance. Cognitive misfit is a lack of fit between a person's cognitive style and task characteristics. Participating auditors were required to perform two judgment tasks and complete a cognitive style questionnaire. Tests for an interactive task performance effect between task type and auditor cognitive characteristics were performed. As expected, auditor cognitive style significantly interacts with the task type. Analytic auditors performed better on the analytic task than the intuitive task. Likewise, intuitive auditors performed better on the intuitive task than on the analytic task. Limitations and implications of the research are discussed.