A simple text-based shoulder surfing resistant graphical password scheme

Traditional text based password schemes are subjected to dictionary attacks on a very large scale. As a solution, graphical password schemes are a promising alternative to text-based recognition schemes where instead of text, images are chosen for a password. However, these schemes are again affected due to shoulder surfing and less effective due to large dictionary space. This paper focuses on providing a solution based on text-based graphical password techniques, a combination of Déjà vu and Moveable Frame scheme. Déjà vu is further replaced by text-based images than purely graphics. Our research has two main objectives: 1) To thwart shoulder surfing 2) To minimize the search time of pass images on the login screen. The project was implemented as a resulting android application using Android Studio. Results show the proposed scheme of graphical password system with multiple alphabet images is more recognizable and has less cognitive load on user as compared to image based graphical password schemes. The incorrect login rate for multiple alphabet based images with movable frame was 15% more than graphical password schemes thus a better solution to protect shoulder surfing.

Shoulder surfing is an easy attack, where an unauthorized user tries to gain access to sensitive information. Unfortunately, none of the currently available content-based shoulder-surfing approaches for protected graphical concealed keywords are both trustworthy and professional. This paper proposes an authentication technique that operates on touchscreen devices with an aim to solve the problem of shoulder-surfing assaults over validation. Graphical passwords are required to get access to the system and to assist with its security. A graphical password is a type of password that can be used instead of a textual password to gain access to a system. It is safer than a written password, which is vulnerable to a shoulder-surfing assault. In this study, we used a falsification technique to create a system that is immune to shoulder-surfing assaults. As a result, the hacker will be perplexed when attempting to obtain and misuse the password. Using Android Studio, the proposed scheme was developed into an android application composed of shoulder-surfing resistant user registration and login process. When compared with other graphical password techniques based on images, the proposed the technique of graphical authentication mechanism with numbers/digits is more easy to memorize and has less cognitive strain on the user. Our graphical authentication technique has more complexity and larger password space than the conventional numeric password schemes, making it a superior method for safeguarding against shoulder surfing attacks. To meet customer expectations, this project seeks to design a graphical password by combining processes such as long key press, and acceleration detection mechanism of Android devices.

In this paper, we discuss how to prevent users' passwords from being stolen by adversaries. Textual-based password authentication scheme tend to be more vulnerable to attacks such as shoulder surfing. To overcome the vulnerabilities of traditional methods, visual or graphical password schemes have been developed as possible alternative solutions to text-based scheme. But simply adopting graphical password authentication also has some drawbacks; hence some hybrid schemes based on text as well as graphics were developed. We propose a virtual password concept involving a small amount of human computing to secure users' passwords in on-line environments. We also analyze how the proposed scheme defends against phishing, key logger, shoulder-surfing, man in the middle and session hijacking attacks.

User authentication is an essential step in information security. Textual passwords are the most traditional ways used in most user authentication systems to achieve the security of information, but textual passwords are vulnerable to many types of attacks such as: dictionary attacks, shoulder surfing, and spyware. Graphical password can overcome the shortcomings of the textual passwords, but it still vulnerable to shouldersurfing attacks, takes much space in the system and sometimes user takes a long time to enter. By using Emoji-pictures, a new technique that overcomes the drawbacks of both textual and graphical passwords was presented in this paper. The proposed technique is resistant to dictionary attacks, shoulder surfing, and spyware in addition to that it doesn't take large space in the system's database and provides a safe and enjoyable session for users during entering the password.

PassBYOP is a new graphical password scheme for public terminals that replaces the static digital images typically used in graphical password systems with personalized physical tokens, herein in the form of digital pictures displayed on a physical user-owned device such as a mobile phone. Users present these images to a system camera and then enter their password as a sequence of selections on live video of the token. Highly distinctive optical features are extracted from these selections and used as the password. We present three feasibility studies of PassBYOP examining its reliability, usability, and security against observation. The reliability study shows that image-feature based passwords are viable and suggests appropriate system thresholds—password items should contain a minimum of seven features, 40% of which must geometrically match originals stored on an authentication server in order to be judged equivalent. The usability study measures task completion times and error rates, revealing these to be 7.5 s and 9%, broadly comparable with prior graphical password systems that use static digital images. Finally, the security study highlights PassBYOP's resistance to observation attack—three attackers are unable to compromise a password using shoulder surfing, camera-based observation, or malware. These results indicate that PassBYOP shows promise for security while maintaining the usability of current graphical password schemes.

In general, it is difficult to remember a strong password i.e. a long and random password. So, the common tendency of a user is to select a weak alphanumeric password that is easy to remember. But the password which is easy to remember is also easy to predict. In contrast, the password that is very difficult to predict or requires more computation to break is also difficult to remember. To overcome this limitation of creating secure and memorable passwords, researchers have developed graphical password scheme which takes images as passwords rather than alphanumeric characters. But graphical password schemes are vulnerable to shoulder-surfing attack where an attacker can capture a password by direct observation. In this paper a graphical password scheme, namely SG-PASS is proposed which can prevent the shoulder-surfing attack by a human observer and also spyware attack, using a challenge response method.

텍스트 기반 패스워드 인증의 문제점을 해결하기 위해서 이미지를 사용하는 그래픽 패스워드가 발전 하였다. 기본적으로 그래픽 패스워드는 화면에 보이는 이미지 위의 정확한 점의 위치를 순서대로 선택(클릭)하여 인증을 처리하는 방식이다. 이러한 기존의 그래픽 패스워드 방식은 화면상의 정확한 지점을 선택하여 클릭하지 못하면 인식에 실패한다. 본 논문에서는 이러한 단점을 개선한 신 개념의 그래픽 패스워드 방식인 PassPositions를 소개한다. PassPositions는 지금까지의 그래픽 패스워드 방식에서 사용하지 않았던 상대위치를 패스워드 생성에 사용한 신개념의 그래픽 패스워드 기법이다. PassPositions는 유니버설 디자인에 기반을 둔 그래픽 패스워드 기법으로 사용자의 신체적 조건에 관계없이 모두가 편리하게 사용할 수 있다. Graphical passwords using images have been developed to solve problems in text based password recognition. The basic recognition process scheme of graphical passwords is clicking certain points on the screen image in correct order. In this pre-developed method of graphical passwords the recognition will fail if the precise positions are not clicked. A new graphical password system called PassPositions is introduced in this paper. PassPositions is a new graphical password scheme which is using relative positions never used earlier graphical password schemes. PassPositions is a graphical password scheme based on universal design that everybody can use conveniently without regarding their physical conditions.

The authentication textual passwords are the most widely used technique. However, this type of legacy authentication is vulnerable to various attacks, such as shoulder-surfing attacks. Hence, graphical password authentication is one of these approaches which has been suggested to overcome the issues related to textual passwords. Nevertheless, the hackers have also developed new techniques that can be finally broken the graphical password, for instance, listening to the transmitted information between the client and the server. In this paper, Passnumbers graphical authentication password is proposed. Passnumbers approach involves two new stages, which are first, using the coordinates of a graphical grid cells-based numbers for entering the password. The second stage is represented by deploying a new technique to encrypt the password based on the image pixels. The performance evaluation reveals that the proposed Passnumbers can provide high resistance against several graphical password attacks including shoulder surfing and eavesdropping attacks. Passnumbers is evaluated using several metrics including security and usability.

Graphical passwords are an alternative form of authentication that use images for login, and leverage the picture superiority effect for good usability and memorability. Categories of graphical passwords have been distinguished on the basis of different kinds of memory retrieval (recall, cued-recall, and recognition). Psychological research suggests that leveraging recognition memory should be best, but this remains an open question in the password literature. This paper examines how different kinds of memory retrieval affect the memorability and usability of random assigned graphical passwords. A series of five studies of graphical and text passwords showed that participants were able to better remember recognition-based graphical passwords, but their usability was limited by slow login times. A graphical password scheme that leveraged recognition and recall memory was most successful at combining memorability and usability.

Graphical passwords are considered to be a secure and memorable alternative to text passwords. Users of such systems, authenticate themselves by identifying a subset of images from the set of displayed images. However, despite the impressive results of user studies on experimental graphical passwords schemes, their overall commercial adaptations have been relatively low. In this paper, we investigate the reasons behind the low commercial acceptance of graphical passwords and present recommendations to overcome the same. Based on these recommendations, we design a simple graphical password scheme, which we call as NAPTune. NAPTune is aimed to work as a cued recognition based graphical authentication scheme that allows users to choose both text as well as images as their password with the same underlying design and interaction. In doing so, we blend the strengths of Numbers, Alphabets and Pictures (NAP) together to effectively defeat prevalent forms of social hacking. We conducted a user study with 35 participants to evaluate the viability of our proposed design. Results of the study are encouraging which indicates that our proposed design is potentially secure and usable method of authentication.

In this paper Image Based Authentication application is applied on folder's (folders that are confidential to user) ,since the studies till date have shown that textual passwords are more prone that they are well hacked by hackers through easily available software's or programming different code to hack the password. The textual passwords use languages that can be identified using the grammar that they use, therefore our project focuses on Graphical passwords , because as such it has been observed that human brains is better at re-collecting and recognizing images than text, the images are well captured and stored rather than text. There have been phases in creating a strong graphical password scheme from 1999, with the promise that the graphical passwords would provide improved password memorability and usability. The technique that we use here is PCCP (PERSUASIVE CUED CLICK POINTS), this is a combination of recall and recognition based techniques with the implementation of SHA1 (Secure Hash Algorithm). Here PCCP is used for user to have better strong passwords by expanding password space and SHA1 is used to ensure security to folder. Keyword: Authentication, Graphical Password, Hotspot, Passpoints, Secure Hash Algorithm,

Today’s computer users have to remember several passwords for each of their accounts. It is easily noticed that people may have difficulty in remembering multiple passwords, which result in a weak password selection. Previous studies have shown that recall success rates are not statistically dissimilar between textual passwords and graphical passwords. With the advent of map-based graphical passwords, this paper focuses on multiple password interference and presents a pilot study consisting of 60 participants to study the recall of multiple passwords between text passwords and map-based passwords under various account scenarios. Each participant has to create six distinct passwords for different account scenarios. It is found that participants in the map-based graphical password scheme could perform better than the textual password scheme in both short-term (one-hour session) and long term (after two weeks) password memorability tests (i.e., they made higher success rates). Our effort attempts to complement existing studies and stimulate more research on this issue.

Authentication is one of the most important mechanisms to ensure system accessibility by legitimate users. Various authentication tools exist based on numerous techniques. Distinguishing factors of such authentication tools are the underlying passwords that they imply. These passwords can be textual based, graphical based, hardware based or biometric based. All such password types have their pros and cons. The principle focus of this research is picture-based graphical passwords, since they are easy to remember and can overcome the limitations of using long textual passwords for stronger security. However, mostly the picture-based passwords suffer from shoulder surfing attacks and are therefore vulnerable. If this vulnerability is overcome then such graphical passwords are highly useful because of their strength and ease of use as compared to long textual passwords. The main objective of this research is to propose and develop a picture-based authentication scheme with anti shoulder surfing capability. The proposed authentication scheme consists of both password creation and usage. Both these stages are supported by specialized technical constructs that overcome the anti shoulder surfing attack even if the attacker is standing next to the legitimate user.

Objectives: Security of textual passwords is increased against offline guessability attacks by using different encryption methods. However, even after encryption textual passwords may be guessed through brute-force or dictionary attacks. Method: In this paper, a theoretical framework is developed which provides guidelines for improving password security against offline guessability attacks such as brute force and dictionary attacks. In the proposed framework different password security layers are defined which convert a password into a form which is very difficult to crack through offline guessability attacks. The framework layers are implemented at application and database level. Findings: In the proposed framework a short and easy to remember password string is converted into a long and random string which does not provide any hint of original password. However, it is important that the methodology or logic used for implementing the framework layers should be hidden from the attackers because the layers’ methodology may provide a clue for password cracking. Layers of the proposed framework can be implemented with different logics, which are helpful in hiding the implementation details of the layers. Application/Improvements: Proposed framework is not only helpful for improving security of traditional textual password scheme but it can also improve the security for graphical password schemes against offline guessability attacks. Keywords: Authentication, Guessability Attacks, Privacy, Password Security, Textual Passwords

Graphical passwords are considered to be one of the promising alternatives to conventional textual passwords. However, while offering potential theoretical improvements over their textual counterparts, it is important to evaluate how these authentication methods would fare in practice. In this study, we were interested in the user-generated passwords from the security and usability perspective. We conducted an experiment in which the participants were tasked to create and memorize three types of passwords: a textual password, a chess-based graphical password, and an association-based hybrid textual-graphical password. Two weeks after the initial registration, the users were prompted to login using their previously created passwords. By comparing the authentication methods, we showed that despite the graphical passwords’ advantages, the user-created chess passwords were the weakest, and the users had the most difficulty remembering them after the two-week period. On the contrary, the association-based passwords were just as strong and memorable as the textual passwords. The conclusions drawn from this paper are therefore two-fold: firstly, alternative authentication methods should be evaluated and compared against textual passwords in reallife scenarios to determine their practical value; and secondly, association-based approaches have the potential to augment both the security and memorability of the existing and novel authentication mechanisms.