Abstract:The passwords for authenticating users are susceptible to shoulder-surfing attacks in which attackers learn users' passwords through direct observations without any technical support. A straightforward solution to defend against such attacks is to change passwords periodically or even constantly, making the previously observed passwords useless. However, this may lead to a situation in which users run out of strong passwords they can remember, or they are forced to choose passwords that are weak, correlated, or difficult to memorize. To achieve both security and usability in user authentication, we propose EvoPass, the first evolvable graphical password authentication system. EvoPass transforms a set of user-selected pass images to pass sketches as user credentials. Users are required to identify their pass sketches from a set of challenge images for user authentication. Particularly, EvoPass improves password strength gradually over time through continually degrading pass sketches without annoying users to reselect pass images. The evolving feature makes it difficult for observational adversaries to identify the pass sketches, even though part of pass sketches may have been exposed to adversaries previously. We introduce two metrics, Information Retention Rate (IRR) and Password Diversity Score (PDS) to guide the process of generating pass sketches and a set of challenge images. Our experimental analysis reveals that applying reasonable IRR and PDS in EvoPass can remarkably improve the resistance to shoulder-surfing attacks without negatively affecting user experience. We also implement a prototype of EvoPass on Android platform with reasonable IRR and PDS applied. Our experimental results on the prototype further demonstrate that EvoPass could work efficiently and achieve a desired usability.

A New Graphical Password Scheme Resistant to Shoulder-Surfing

A Graphical Password Scheme Against Snapshot, Remote Monitoring, and Shoulder-Surfing with Its Application in One-Time Password

Draw a Line on Your PDA to Authenticate.

A Shoulder Surfing Resistant Graphical Authentication System

Against Spyware Using CAPTCHA in Graphical Password Scheme

An Interactive and Secure User Authentication Scheme for Mobile Devices.

PassPage - Graphical Password Authentication Scheme Based on Web Browsing Records.

EvoPass: Evolvable Graphical Password Against Shoulder-Surfing Attacks

PassApp: My App is My Password!

Scribble-a-Secret: Similarity-based Password Authentication Using Sketches

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Poster: Using Chinese Characters For Authentication-Algorithmic Framework And Empirical Results

KinWrite: Handwriting-Based Authentication Using Kinect.

An Exploration of Graphical Password Authentication for Children

Passmap: A Map Based Graphical-Password Authentication System

From Hot-Spots Towards Experience-Spots: Leveraging on Users' Sociocultural Experiences to Enhance Security in Cued-Recall Graphical Authentication.

A Case Study of Graphical Passwords in a Chinese University

On the Security of Picture Gesture Authentication.

Quantifying the Security of Recognition Passwords: Gestures and Signatures

A secure image-based authentication scheme for mobile devices

Secure Password-based Remote User Authentication Scheme Against Smart Card Security Breach