On User Choice in Graphical Password Schemes

By Darren Davis, Fabian Monrose, Michael K. Reiter. USENIX Security Symposium, 2004

604 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/25f4ac8e021b7304227e0d3f4ce01741b0ce9f92

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Fast dictionary attacks on passwords using time-space tradeoff (2005, methodology): “Possible techniques include graphical passwords [18, 36, 8 ], reverse Turing tests [31, 35], and hardening passwords with biometric information [26].”
A Usability Study and Critique of Two Password Managers (2006, background): “[6] with focus on security and poor user choices made by real users; and Wiedenbeck et al.”
Design and evaluation of a shoulder-surfing resistant graphical password scheme (2006, background): “Another potential drawback is that users may be strongly attracted to certain images [4, 6].”
The battle against phishing: Dynamic Security Skins (2005, background): “If an attacker has some knowledge of the user, and if the selection of images is limited, the choice of image may be predictable [33].”
What's in a Name? (2020, methodology): “In Figure 1 we plot the Facebook name distributions against textual passwords [16,28,27], mnemonic passwords [17], the Pass-Go user-drawn password system [22], the Passfaces graphical PIN system [29], the PassPoints visually-cued clicked password system [6] and a handwriting-recognition biometric sy”
A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords (2006, background): “[9] found that users pick faces for graphical passwords in such predictable patterns (i.”
Smudge Attacks on Smartphone Touch Screens (2010, background): “Specifically, it should also be noted that there are several other proposed graphical password schemes [2, 4, 10].”
The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes (2012, background): “[46] study of a version called “Face”; thus more recent versions use systemassigned faces.”
Authentication using graphical passwords: effects of tolerance and image choice (2005, background): “This phenomenon has been shown in face recognition graphical passwords [12], but the danger may be less in our system with good choice of images to avoid hot spots.”
Graphical passwords: a survey (2005, methodology): “For example, studies on the Passface technique have shown that people often choose weak and predictable graphical passwords [19].”
Guessing human-chosen secrets (2012, methodology): “attacked a Passfacesstyle scheme which they called “Faces” in 2004 [78] and found that user preference for attractive faces was prevalent enough that they could break 10% of accounts with just two guesses.”
Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems (2005, background): “More user research is needed to fully understand the potential and limitations of the visual paradigm in authentication systems, with particular attention paid to the effects of multiple visual codes, and biases which occur in user selection of codes (Davis et al., 2004; Renaud and De Angeli, 2004).”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, methodology): “We include both the password-cracking experiments discussed in Section II-A and cracking attempts on two graphical schemes: a 2004 study of user choice in a facebased graphical PIN scheme [47] and a 2005 study of userselected image points in the PassPoints scheme [48].”
Graphical Password Authentication Using Cued Click Points (2007, methodology): “Graphical password schemes can be grouped into three general categories based on the type of cognitive activity required to remember the password: recognition, recall, and cued recall [5,12].”
PassPoints: Design and longitudinal evaluation of a graphical password system (2005, background): “Research has also shown that recognition-based passwords consisting of faces may yield passwords with very low entropy because of predictable ways that users choose the faces that make up their password (Davis et al., 2004).”
Graphical passwords: Learning from the first twelve years (2012, methodology): “Mnemonic strategies like Story [Davis et al. 2004] may improve both usability and security but often suffer from predictability problems if user choice is allowed.”