Graphical Passwords and Usable Security Lecture

This set of vocabulary flashcards covers key concepts from the lecture on graphical passwords, including the psychological theories of memory, specific authentication schemes (DAS, PassFace, Pass points), and the critical distinction between theoretical and effective security spaces.

Dual coding theory

A psychological concept suggesting that people remember images better than arbitrary text, forming the core idea behind graphical passwords.

Recall-based system

A category of graphical passwords where the user must produce a secret from memory without hints, such as drawing a pattern on a grid.

Draw a Secret (DAS)

One of the first recall-based graphical password systems where users create a password by drawing a shape on a $2D$ grid.

Cued recall

A graphical password task where an image acts as a memory cue to help the user recall specific points or coordinates.

Pass points

A cued recall system where users click a sequence of five points on a photo; it is also known as local metric authentication.

Recognition-based system

The easiest memory task for graphical passwords, where a user identifies a previously seen image from a set of decoy images.

PassFace

A recognition-based system where users select a portfolio of faces and must identify them correctly during login rounds.

Theoretical password space

The total number of possible passwords a system can mathematically accept, such as approximately $2^{58}$ for a $5 \times 5$ DAS grid.

Effective password space

The actual, much smaller set of passwords that users tend to choose due to predictable behaviors, which determines the real security of the system.

Hot points

Popular, visually meaningful locations in an image that many users choose as click points, allowing attackers to prioritize them during guessing.

Shoulder surfing

A security threat where an attacker recovers a password by watching a user enter it during the login process.

Depths of processing theory

A theory suggesting that information becomes more memorable based on how many different ways and how deeply a person engages with it.

MVP (Multiple Versatile Passwords)

A plugin and system developed by researchers at Carleton University to implement and test many different kinds of graphical and text password schemes.

Mad Libs (Graphical variant)

A password scheme where a story is parameterized with the user's password objects to help them remember the sequence.

Persuasion theory

The application of psychological techniques to guide users into choosing stronger passwords during the creation phase.

Passkeys

A modern authentication solution created by the Fido Alliance and supported by Microsoft, Google, and Apple as an alternative to traditional passwords.

Strategic winter avoidance

A lifestyle habit mentioned of Robert Biddle, who spends half the year as professor emeritus in Canada and the other half in Auckland, New Zealand.