Graphical Passwords and Usable Security Lecture

Overview of Graphical Password Research

• Graphical passwords emerged around $1999$ as a proposed solution to the inherent vulnerabilities of text-based passwords.

• Text-based passwords suffer from several systematic failures including:

  • Users picking predictable passwords.

  • Reusing the same password across multiple accounts.

  • Forgetting complex passwords over time.

• The research into graphical alternatives is heavily influenced by the Dual Coding Theory from psychology, which posits that humans remember images and visual information significantly better than arbitrary text segments.

• A central theme across all graphical password research is the discrepancy between the Theoretical Password Space (the total number of mathematical combinations allowed by the system) and the Effective Password Space (the actual pool of passwords users choose from once human behavior and predictability are accounted for).

Evolutionary Psychology and Theories of Memory

• Dual Coding Theory: This theory suggests that image-based passwords should be more memorable than text-based ones because of the way the brain processes visual versus verbal information.

• Depths of Processing Theory: This theory has largely superseded Dual Coding. It suggests that information becomes more memorable based on how many different ways a person engages with it and the "depth" of that engagement. For example, a face is not just memorable because it is an image, but because of repeated interactions, conversations, and emotional significance.

• Face Recognition: There is a specific part of the brain dedicated to facial recognition, leading researchers to believe faces would be the most effective recognition-based password. However, empirical testing showed that while faces are memorable, distinct objects (e.g., hairbrush, weather vane) are often more effective because facial recognition tasks can be hampered by familiarity bias and visual interference from decoy images during the login process.

Taxonomy of Graphical Passwords

Graphical password schemes are generally categorized into three distinct memory tasks:

• Recall-Based Systems: The user must reproduce a secret from memory without any visual hints.

  • Example: Draw-a-Secret (DAS). Users draw a pattern or shape on a $2D$ grid. The system records the sequence of grid cells the drawing passes through.

• Cued Recall Systems: An image acts as a visual cue to help the user recall specific points or coordinates.

  • Example: PassPoints. Users click a sequence of five points on a specific photograph. This is also called "local metric authentication."

• Recognition-Based Systems: This is considered the easiest cognitive task. Users identify their secret image(s) from a set of decoy images.

  • Example: PassFace. Users select a portfolio of faces and must identify them across multiple rounds of login screens.

Empirical Analysis of Authentication Schemes

Draw-a-Secret (DAS)

• Theoretical Space: Using a $5 \times 5$ grid with a maximum length of $12$, the theoretical space is approximately $2^{58}$.

• Effective Reality: Testing against $167$ real users showed that behavior is highly predictable.

  • $72\%$ of users used $4$ strokes or fewer.

  • Only $40\%$ of users drew asymmetric patterns.

• Vulnerability: Attackers use search strategies based on simple, symmetric patterns drawn near the center of the grid. This makes the attack dictionary approximately $100,000,000$ times smaller than the theoretical space.

PassFace

• Theoretical Space: A system using four rounds with nine faces per round yields a space of $9^4$, or approximately $2^{13}$.

• User Performance: In a study of $77$ users, $72\%$ to $100\%$ logged in successfully by their third attempt. A $10$-week field study showed a $95\%$ success rate even after a $5$-month delay.

• Predictability: Users tend to pick faces of their own race or faces they find attractive. For the weakest $25\%$ of users, an attacker needs only $13$ guesses; for the weakest $10\%$, only $2$ guesses are needed.

PassPoints

• Theoretical Space: Can reach $2^{43}$ depending on the image size and the tolerance area (the pixel radius around a click that the system accepts as correct).

• Security Failures: Since users choose meaningful visual locations ("hotspots") rather than random coordinates, security collapses.

  • Geometric Bias: Users often click in a straight line.

  • Hotspot Attacks: Three guesses can find $7\%$ to $10\%$ of real passwords.

  • Fully Automatic Attacks: These can identify $48\%$ to $54\%$ of passwords by guessing common visual lines across any photo, regardless of content.

Key Challenges and Practical Constraints

• Entry Time: While text passwords usually take approximately $5\,s$ to enter, recognition-based graphical passwords can take up to $1\,min$. Users must scan a grid and ask "is this my image?" for every cell, making the process too time-consuming for daily use.

• Subvocalization: During recognition tasks involving objects, users often remember the words for the objects rather than the images themselves (e.g., repeating "Chair, Stapler, Football, Scissors" under their breath). This effectively turns a graphical password back into a text password, which can be overheard.

• The Shoulder Surfing Problem: Graphical systems are often more vulnerable to observers watching the screen. Some systems shuffle the grid to prevent this, but this further increases the time required for the user to find their images.

• The Password Lifecycle: Modern users manage $10$, $20$, or even $100$ different accounts. Memorizing this many unique graphical passwords is cognitively infeasible.

• Phishing and Malware: No password system—text or graphical—is secure if the machine is infected with malware. Keyloggers and screen-capture software can easily record the authentication process.

Modern Authentication Solutions

• Password Managers: Systems built into platforms like Microsoft, Google, and Apple are now the recommended standard. They allow users to have a single strong "Master Password" (which could be graphical) that maps to unique, complex text passwords for every site.

• Passkeys: Developed by the Fido Alliance, these are intended to replace passwords entirely. However, they face two major hurdles:

  1. Poor Communication: Explanations of passkeys to the general public are often confusing.

  2. Implementation Gaps: There is no universal standard for website administrators to implement passkey support, leading to a fragmented and buggy ecosystem.

• Persuasion Theory: Research has attempted to use "persuasion" to nudge users into picking stronger graphical passwords. While initially successful, users eventually regress to easy, memorable patterns as the number of passwords they must manage increases.

Questions & Discussion

Question: Where does the argument for graphical passwords break down? Is the psychology wrong, or is it just irrelevant to authentication? Response: It is a combination of factors. Psychological theories like Dual Coding or Depths of Processing are correct in principle—images are more memorable. However, the practical application fails because recognition-based systems take too long to enter, and users are forced to choose from randomly assigned images to maintain security, which negates the memorability benefit. Furthermore, the modern requirement to manage dozens of passwords makes any single strong scheme difficult to scale.

Question: Are we currently in the "second generation" of graphical passwords, or has the field been replaced by biometrics and passkeys? Response: Much of the work after $2011$ focused on "Third Generation" systems like MVP (Multiple Versatile Passwords), which used plug-ins for real websites to test things like image pastiles (shuffled grids) and Mad Libs (story-based memory aids). While creative, none of these systems solved the core issues of entry time and the effective password space. The technology is largely shifting toward biometrics and passkeys, though graphical passwords remain a viable option for master passwords in management systems.

Question: What does the future of passwords look like? Response: The future likely lies in integrated password managers and passkeys. While many experts remain reticent to trust password managers for their most sensitive accounts, they are vastly superior to common user habits like password reuse or writing passwords down. The transition to passkeys will require better standardization and clearer public education to be successful.

Experimental Methodologies in Usability

• Empirical Research: The value of this field lies in running human studies and using statistical tests of significance. It prevents researchers from assuming a system is "cool" and therefore effective.

• Salient Point Tracking: Researchers have used eye-tracking cameras to predict which points a user will choose on a photograph for PassPoints. If a camera can track what a human finds visually interesting, an attacker can use similar algorithms to guess the password.

• User Choice Persuasion: Efforts to force users away from hotspots through system-guided choices often fail long-term as users prioritize convenience and speed over theoretical security.