Graphical passwords: a survey <s> Introduction <s> The S s looked through a series of about 600 stimuli selected at random from an initially larger population. They were then tested for their ability to recognize these “old” stimuli in pairs in which the alternative was always a “new” stimulus selected at random from the stimuli remaining in the original population. Depending upon whether this original population consisted solely of words, sentences, or pictures, median Ss were able correctly to recognize the “old” stimulus in 90, 88, or 98% of the test pairs, respectively. Estimated lower bounds on the informational capacity of human memory considerably exceed previously published estimates. <s> BIB001 </s> Graphical passwords: a survey <s> Introduction <s> This workshop will seek to understand the roles and demands placed on users of security systems, and explore design solutions that can assist in making security systems usable and effective. In addition to examining end-users, this workshop will also examine the issues faced by security system developers and operators. The goal of the workshop is to build a network of interested people, share research activities and results, discuss high priority areas for research and development, and explore opportunities for collaboration. <s> BIB002
Human factors are often considered the weakest link in a computer security system. Patrick, et al. BIB002 point out that there are three major areas where humancomputer interaction is important: authentication, security operations, and developing secure systems. Here we focus on the authentication problem. The most common computer authentication method is for a user to submit a user name and a text password. The vulnerabilities of this method have been well known. One of the main problems is the difficulty of remembering passwords. Studies have shown that users tend to pick short passwords or passwords that are easy to remember  . Unfortunately, these passwords can also be easily guessed or broken. According to a recent Computerworld news article, the security team at a large company ran a network password cracker and within 30 seconds, they identified about 80% of the passwords  . On the other hand, passwords that are hard to guess or break are often hard to remember. Studies showed that since user can only remember a limited number of passwords, they tend to write them down or will use the same passwords for different accounts   . To address the problems with traditional usernamepassword authentication, alternative authentication methods, such as biometrics   , have been used. In this paper, however, we will focus on another alternative: using pictures as passwords. Graphical password schemes have been proposed as a possible alternative to text-based schemes, motivated partially by the fact that humans can remember pictures better than text; psychological studies supports such assumption BIB001 . Pictures are generally easier to be remembered or recognized than text. In addition, if the number of possible pictures is sufficiently large, the possible password space of a graphical password scheme may exceed that of textbased schemes and thus presumably offer better resistance to dictionary attacks. Because of these (presumed) advantages, there is a growing interest in graphical password. In addition to workstation and web log-in applications, graphical passwords have also been applied to ATM machines and mobile devices. In this paper, we conduct a comprehensive survey of the existing graphical password techniques. We will discuss the strengths and limitations of each method and also point out future research directions in this area. In conducting this survey, we want to answer the following questions: • Are graphical passwords as secure as text passwords? • What are the major design and implementation issues for graphical passwords? This paper will be particularly useful for researchers who are interested in developing new graphical password algorithms as well as industry practitioners who are interested in deploying graphical password techniques.