On User Choice in Graphical Password Schemes
Date: August 11 2004
Publication: Proceedings of the 13th USENIX Security Symposium, Security '04
Page(s): 151 - 164
Source 1: https://users.ece.cmu.edu/~reiter/papers/2004/usenix2.pdf
Source 2: https://www.usenix.org/legacy/event/sec04/tech/full_papers/davis/davis.pdf
Graphical password schemes have been proposed as an alternative to text passwords in applications that support graphics and mouse or stylus entry. In this paper we detail what is, to our knowledge, the largest published empirical evaluation of the effects of user choice on the security of graphical password schemes. We show that permitting user selection of passwords in two graphical password schemes, one based directly on an existing commercial product, can yield passwords with entropy far below the theoretical optimum and, in some cases, that are highly correlated with the race or gender of the user. For one scheme, this effect is so dramatic so as to render the scheme insecure. A conclusion of our work is that graphical password schemes of the type we study may generally require a different posture toward password selection than text passwords, where selection by the user remains the norm today.
Do you have additional information to contribute regarding this research paper? If so, please email email@example.com with the details.