Measuring the revised guessability of graphical passwords

English, R. and Poet, R. (2011) Measuring the revised guessability of graphical passwords. In: 5th International Conference on Network and System Security (NSS), Milan, Italy, 6-8 Sep 2011, pp. 364-368. (doi: 10.1109/ICNSS.2011.6060031)

Abstract

There is no widely accepted way of measuringthe level of security of a recognition-based graphical password against guessing attacks. We aim to address this by examining the influence of predictability of user choice on the guessability and proposing a new measure of guessability. Davis et al. showed that these biases exist for schemes using faces and stories, we support this result and show these biases exist in other recognition-based schemes. In addition, we construct an attack exploiting predictability, which we term “Semantic Ordered Guessing Attack” (SOGA). We then apply this attack to two schemes (the Doodles scheme and a standard recognition-based scheme using photographic images) and report the results. The results show that predictability when users select graphical passwords influence the level of security to a varying degree (dependent on the distractor selection algorithm). The standard passimages scheme show an increase on guessability of up to 18 times more likely than the usual reported guessability, with a similar set up of nine images per screen and four screens, the doodles scheme shows a successful guessing attack is 3.3 times more likely than a random guess. Finally, we present a method of calculating a more accurate guessability value, which we call the revised guessability of a recognition-based scheme. Our conclusion is that to maximise the security of a recognition-based graphical password scheme, we recommend disallowing user choice of images.

• Item Type: Conference Proceedings
• Additional Information: (c) 2011 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other users, including reprinting / republishing this material for advertising or promotional purposes, creating new collective works for resale or redistribution to servers or lists, or reuse of any copyrighted components of this work in other works.
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Poet, Dr Ron and English, Dr Rosanne
• Authors: English, R., and Poet, R.
• Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
• College/School: College of Science and Engineering > School of Computing Science
• Copyright Holders: Copyright © 2011 IEEE
• Publisher Policy: Reproduced in accordance with the copyright policy of the publisher