Facelock: familiarity-based graphical authentication

Jenkins, R., McLachlan, J. L. and Renaud, K. (2014) Facelock: familiarity-based graphical authentication. PeerJ, 2, e444. (doi:10.7717/peerj.444)

[img]
Preview
Text
99252.pdf - Published Version
Available under License Creative Commons Attribution.

8MB

Publisher's URL: http://dx.doi.org/10.7717/peerj.444

Abstract

Authentication codes such as passwords and PIN numbers are widely used to control access to resources. One major drawback of these codes is that they are difficult to remember. Account holders are often faced with a choice between forgetting a code, which can be inconvenient, or writing it down, which compromises security. In two studies, we test a new knowledge-based authentication method that does not impose memory load on the user. Psychological research on face recognition has revealed an important distinction between familiar and unfamiliar face perception: When a face is familiar to the observer, it can be identified across a wide range of images. However, when the face is unfamiliar, generalisation across images is poor. This contrast can be used as the basis for a personalised 'facelock', in which authentication succeeds or fails based on image-invariant recognition of faces that are familiar to the account holder. In Study 1, account holders authenticated easily by detecting familiar targets among other faces (97.5% success rate), even after a one-year delay (86.1% success rate). Zero-acquaintance attackers were reduced to guessing (<1% success rate). Even personal attackers who knew the account holder well were rarely able to authenticate (6.6% success rate). In Study 2, we found that shoulder-surfing attacks by strangers could be defeated by presenting different photos of the same target faces in observed and attacked grids (1.9% success rate). Our findings suggest that the contrast between familiar and unfamiliar face recognition may be useful for developers of graphical authentication systems.

Item Type:Articles
Status:Published
Refereed:Yes
Glasgow Author(s) Enlighten ID:Renaud, Professor Karen and Jenkins, Dr Rob
Authors: Jenkins, R., McLachlan, J. L., and Renaud, K.
College/School:College of Science and Engineering > School of Computing Science
College of Science and Engineering > School of Psychology
Journal Name:PeerJ
Publisher:PeerJ
ISSN:2167-8359
Copyright Holders:Copyright © 2014 The Authors
First Published:First published in PeerJ 2:e444
Publisher Policy:Reproduced under a Creative Commons License
Related URLs:

University Staff: Request a correction | Enlighten Editors: Update this record