Graphical passwords: a survey <s> Reproduce a Drawing <s> A user identification system is very important for protecting information from illegal access. There are identification systems using standard devices (keyboard or mouse) and systems using special devices. A user identification system using mouse is proposed in [6]. In their system, users write a simple figure object and the successful verification rate is 87%. However the simple object is too easy to prevent impersonation. In order to realize a more reliable user identification system using mouse, we propose a new system to identify users using a complex figure object, signature. New techniques we utilize in our system are as follows: the normalization of input data, the adoption of new signature-writing-parameters, the evaluation of verification data using geometric average means and the dynamical update of database. We have implemented our user identification system and conducted experiments of the implemented system. The successful verification rate in our system is 93%. <s> BIB001 </s> Graphical passwords: a survey <s> Reproduce a Drawing <s> In this paper we propose and evaluate new graphical password schemes that exploit features of graphical input displays to achieve better security than text-based passwords. Graphical input devices enable the user to decouple the position of inputs from the temporal order in which those inputs occur, and we show that this decoupling can be used to generate password schemes with substantially larger (memorable) password spaces. In order to evaluate the security of one of our schemes, we devise a novel way to capture a subset of the "memorable" passwords that, we believe, is itself a contribution. In this work we are primarily motivated by devices such as personal digital assistants (PDAs) that offer graphical input capabilities via a stylus, and we describe our prototype implementation of one of our password schemes on such a PDA, namely the Palm PilotTM. <s> BIB002 </s> Graphical passwords: a survey <s> Reproduce a Drawing <s> Password security often fails in practice because users select predictable passwords. We conducted a study to explore the use of hand-drawn doodle password ("passdoodle"). Our findings show that users could recall all visual elements of the doodle as well as they could recall alphanumeric passwords, but most could not perfectly redraw their selected doodles. Users perceive passdoodles as easier to remember than alphanumeric passwords; however, they prefer whichever authentication method they perceive to be more secure. <s> BIB003 </s> Graphical passwords: a survey <s> Reproduce a Drawing <s> In commonplace textual password schemes, users choose passwords that are easy to recall. Since memorable passwords typically exhibit patterns, they are exploitable by brute-force password crackers using attack dictionaries. This leads us to ask what classes of graphical passwords users find memorable. We postulate one such class supported by a collection of cognitive studies on visual recall, which can be characterized as mirror symmetric (reflective) passwords. We assume that an attacker would put this class in an attack dictionary for graphical passwords and propose how an attacker might order such a dictionary. We extend the existing analysis of graphical passwords by analyzing the size of the mirror symmetric password space relative to the full password space of the graphical password scheme of Jermyn et al. (1999), and show it to be exponentially smaller (assuming appropriate axes of reflection). This reduction in size can be compensated for by longer passwords: the size of the space of mirror symmetric passwords of length about L + 5 exceeds that of the full password space for corresponding length L ≤ 14 on a 5 × 5 grid. This work could be used to help in formulating password rules for graphical password users and in creating proactive graphical password checkers. <s> BIB004 </s> Graphical passwords: a survey <s> Reproduce a Drawing <s> In ubiquitous textual password schemes, users choose passwords that contain predictable characteristics that are roughly equated with what users flnd easy to recall. This motivates us to examine user choice in graphical passwords to determine whether predictable characteristics exist that may reduce the entropy of the password space. We present an informal user study of the scheme proposed by Jermyn et al. (1999), and the results, both in context of the study’s goals and a separate analysis of the results performed at a later date. Our results support that user drawings contain the predictable characteristics relating to symmetry, number of composite strokes, and centering within the grid. Our results also highlight a usability challenge with the DAS scheme. <s> BIB005 </s> Graphical passwords: a survey <s> Reproduce a Drawing <s> Access to computer systems is most often based on the use ofalphanumeric passwords. However, users have difficultyremembering a password that is long and randomappearing.Instead, they create short, simple, and insecurepasswords. Graphical passwords have been designed to tryto make passwords more memorable and easier for people touse and, therefore, more secure. Using a graphicalpassword, users click on images rather than typealphanumeric characters.. In this paper we describe theDAS(Draw-A-Secret) scheme, its security characteristics,and the empirical study we carried out comparing DAS toalphanumeric passwords. In the empirical study participantslearned either an alphanumeric or graphical password andsubsequently carried out three longitudinal trials to inputtheir passwords over a period of five weeks. The results showthat the graphical group took longer and made more errorsin learning the password, but that the difference was largelya consequence of just a few graphical participants who haddifficulty learning to use graphical passwords. In thelongitudinal trials the two groups performed similarly onmemory of their password, but the graphical group tookmore time to input a password. <s> BIB006
Jermyn, et al. BIB002 proposed a technique, called "Draw -a -secret (DAS)", which allows the user to draw their unique password (figure 6). A user is asked to draw a simple picture on a 2D grid. The coordinates of the grids occupied by the picture are stored in the order of the drawing. During authentication, the user is asked to re-draw the picture. If the drawing touches the same grids in the same sequence, then the user is authenticated. Jermyn, et al. suggested that given reasonable-length passwords in a 5 X 5 grid, the full password space of DAS is larger than that of the full text password space. Thorpe and van Oorschot BIB004 analyzed the memorable password space of the graphical password scheme by Jermyn et al. BIB002 . They introduced the concept of graphical dictionaries and studied the possibility of a brute-force attack using such dictionaries. They defined a length parameter for the DAS type graphical passwords and showed that DAS passwords of length 8 or larger on a 5 x 5 grid may be less susceptible to dictionary attack than textual passwords. They also showed that the space of mirror symmetric graphical passwords is significantly smaller than the full DAS password space. Since people recall symmetric images better than asymmetric images, it is expected that a significant fraction of users will choose mirror symmetric passwords. If so, then the security of the DAS scheme may be substantially lower than originally believed. This problem can be resolved by using longer passwords. Thorpe and van Oorschot showed that the size of the space of mirror symmetric passwords of length about L + 5 exceeds that of the full password space for corresponding length L <= 14 on a 5 x 5 grid. Thorpe and van Oorschot BIB006 further studied the impact of password length and stroke-count as a complexity property of the DAS scheme. Their study showed that stroke-count has the largest impact on the DAS password space --The size of DAS password space decreases significantly with fewer strokes for a fixed password length. The length of a DAS password also has a significant impact but the impact is not as strong as the stroke-count. To improve the security, Thorpe and van Oorschot proposed a "Grid Selection" technique. The selection grid is an initially large, fine grained grid from which the user selects a drawing grid, a rectangular region to zoom in on, in which they may enter their password ( figure 7 ). This would significantly increase the DAS password space. Goldberg et al. BIB003 did a user study in which they used a technique called "Passdoodle". This is a graphical password comprised of handwritten designs or text, usually drawn with a stylus onto a touch sensitive screen. Their study concluded that users were able to remember complete doodle images as accurately as alphanumeric passwords. The user studies also showed that people are less likely to recall the order in which they drew a DAS password. However, since the user study was done using a paper prototype instead of computer programs, with verifications done by a human rather than computer, the accuracy of this study is still uncertain. Nali and Thorpe BIB005 conducted further analysis of the "Draw-A-Secret (DAS)" scheme BIB002 . In their study, users were asked to draw a DAS password on paper in order to determine if there are predictable characteristics in the graphical passwords that people choose. The study did not find any predictability in the start and end points for DAS password strokes, but found that certain symmetries (e.g. crosses and rectangles), letters, and numbers were common. This study showed that users choose graphical passwords with predictable characteristics, particularly those proposed as "memorable". If this study is indicative of the population, the probability in which some of these characteristics occur would reduce the entropy of the DAS password space. However, this user study only asked the users to draw a memorable password, but did not do any recall-test on whether or not the passwords were really memorable. Syukri, et al. BIB001 proposes a system where authentication is conducted by having the user drawing their signature using a mouse (figure 8 verification. During the registration stage: the user will first be asked to draw their signature with a mouse, and then the system will extract the signature area and either enlarge or scale-down the signature, and rotates if needed, (also known as normalizing). The information will later be saved into the database. The verification stage first takes the user input, and does the normalization again, and then extracts the parameters of the signature. After that, the system conducts verification using geometric average means and a dynamic update of the database. According to the paper the rate of successful verification was satisfying. The biggest advantage of this approach is that there is no need to memorize one's signature and signatures are hard to fake. However, not everybody is familiar with using a mouse as a writing device; the signature can therefore be hard to draw. One possible solution to this problem would be to use a pen-like input device, but such devices are not widely used, and adding new hardware to the current system can be expensive. We believe such a technique is more useful for small devices such as a PDA, which may already have a stylus.