Quantifying the Security of Graphical Passwords: The Case of Android Unlock Patterns
Author(s): Sebastian Uellenbeck, Markus Dürmuth, Christopher Wolf, Thorsten Holz

Date: November 2013
Publication: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, CCS '13
Page(s): 161 - 172
Publisher: ACM
Source 1: http://emsec.rub.de/media/emma/veroeffentlichungen/2013/09/26/patternLogin-CCS13.pdf
Source 2: http://dx.doi.org/10.1145/2508859.2516700 - Subscription or payment required

Abstract or Summary:
Graphical passwords were proposed as an alternative to overcome the inherent limitations of text-based passwords, inspired by research that shows that the graphical memory of humans is particularly well developed. A graphical password scheme that has been widely adopted is the Android Unlock Pattern, a special case of the Pass-Go scheme with grid size restricted to 3x3 points and restricted stroke count.

In this paper, we study the security of Android unlock patterns. By performing a large-scale user study, we measure actual user choices of patterns instead of theoretical considerations on password spaces. From this data we construct a model based on Markov chains that enables us to quantify the strength of Android unlock patterns. We found empirically that there is a high bias in the pattern selection process, e.g., the upper left corner and three-point long straight lines are very typical selection strategies. Consequently, the entropy of patterns is rather low, and our results indicate that the security offered by the scheme is less than the security of only three digit randomly-assigned PINs for guessing 20% of all passwords (i.e., we estimate a partial guessing entropy G_0.2 of 9.10 bit).

Based on these insights, we systematically improve the scheme by finding a small, but still effective change in the pattern layout that makes graphical user logins substantially more secure. By means of another user study, we show that some changes improve the security by more than doubling the space of actually used passwords (i.e., increasing the partial guessing entropy G_0.2 to 10.81 bit).

Do you have additional information to contribute regarding this research paper? If so, please email siteupdates@passwordresearch.com with the details.

<-- Back to Authentication Research Paper Index

[Home] [About Us] [News] [Research]

Copyright © 2016 PasswordResearch.com