Graphical authentication systems offer a promising alternative to traditional text-based passwords, potentially alleviating the cognitive strain on users and enhancing security. A Cognition-Inspired Design (CID) approach is crucial for developing effective next-generation authentication systems. CID explicitly considers the cognitive processes of both users and attackers. By considering how humans perceive, process, and remember visual information, designers can create graphical authentication systems that are more usable, memorable, and resistant to attacks. This approach has led to innovative graphical authentication schemes that leverage human cognition while mitigating vulnerabilities. Two examples, the Rapid Serial Visual Presentation (RSVP) scheme and the Incognito selection technique, are examined. The RSVP scheme uses degraded images to hinder attacker reconstruction of passcodes. Incognito camouflages passcode selection within grid layouts. Human Factors professionals should develop CID to facilitate end-user compliance with recommended security practices.
AggarwalP.VenkatesanS.YouzwakJ.ChadhaR.GonzalezC. (2024). Discovering cognitive biases in cyber attackers’ network exploitation activities: A case study (Vol.127, pp. 115–126). Proceedings of AHFE International Conference: Human Factors in Cybersecurity, Nice, France.
2.
BiddleR.ChiassonS.Van OorschotP. C. (2012). Graphical passwords: Learning from the first twelve years. ACM Computing Surveys (CSUR), 44, 19.
3.
BiedermanI. (1987). Recognition-by-components: A theory of human image understanding. Psychological Review, 94, 115–147.
4.
BinbeshrF.SiongK. C.ImamM.Al-SaggafA. A.AbudaqaA. A. (2025). A systematic review of graphical password methods resistant to shoulder-surfing attacks. International Journal of Information Security, 24, 1–22.
5.
CainA. A.EdwardsM. E.StillJ. D. (2018). An exploratory study of cyber hygiene behaviors and knowledge. Journal of Information Security and Applications, 42, 36–45.
6.
CainA. A.StillJ. D. (2017). RSVP a temporal method for graphical authentication. Journal of Information Privacy and Security, 13, 226–237.
7.
CainA. A.StillJ. D. (2018). Usability comparison of over-the-shoulder attack resistant authentication schemes. Journal of Usability Studies, 13, 196–219.
8.
CainA. A.WernerS.StillJ. D. (2017). Graphical authentication resistance to over-the-shoulder-attacks (pp. 2416–2422) [Conference session]. Proceedings of the 2017 CHI Conference Extended Abstracts on Human Factors in Computing Systems, Denver, CO, USA.
9.
ChiassonS.ForgetA.BiddleR.van OorschotP. C. (2008). Influencing users towards better passwords: Persuasive cued click-points (pp. 121–130) [Conference session]. British HCI Annual Conference, Liverpool, United Kingdom.
10.
DhamijaR.PerrigA. (2000). Déjà Vu: A user study using images for authentication (Vol. 4) [Conference session]. Proceedings of the 9th Conference on USENIX Security Symposium, Denver, CO, USA.
11.
EnsorT. M.SurprenantA. M.NeathI. (2018). Increasing word distinctiveness eliminates the picture superiority effect in recognition: Evidence for the physical-distinctiveness account. Memory & Cognition, 47, 182–193.
12.
FBI (2023). Internet Crime Complaint Center (ICS) internet crime report. U.S. Department of Justice.
13.
GrawemeyerB.JohnsonH. (2011). Using and managing multiple passwords: A week to a view. Interacting with Computers, 23, 256–267.
14.
HayashiE.DhamijaR.ChristinN.PerrigA. (2008). Use your illusion: Secure authentication usable anywhere (pp. 35–45) [Symposium]. Proceedings of the 4th Symposium on Usable Privacy and Security, Pittsburgh, PA, USA.
15.
HlywaM.BiddleR.PatrickA. S. (2011). Facing the facts about image type in recognition-based graphical passwords (pp. 149–158) [Conference session]. Annual Computer Security Applications Conference, Orlando, FL, USA.
16.
JermynI.MayerA.MonroseF.ReiterM. K.RubinA. (1999). The design and analysis of graphical passwords (pp. 1–15) [Symposium]. USENIX Security Symposium, Washington, D.C, USA.
17.
MatorJ. D.LehmanW. E.McManusW.PowersS.TillerL.UnverrichtJ. R.StillJ. D. (2020). Usability: Adoption, measurement, value. Journal of Human Factors, 63, 956–973.
18.
PaivioA. (1979). Imagery and verbal processes. Psychology Press.
19.
ShammeeT. I.AkterT.MouM.ChowdhuryF.FerdousM. S. (2020). A systematic literature review of graphical password schemes. Journal of Computing Science and Engineering, 14, 163–185.
20.
StillJ. D.BellJ. (2018). Incognito: Shoulder-Surfing resistant selection method. Journal of Information Security and Applications, 40, 1–8.
21.
StillJ. D.CainA.SchusterD. (2017). Human-centered authentication guidelines. Journal of Information & Computer Security, 25, 437–453.
22.
StillJ. D.StillM. L. (2025). Cognition-inspired design in mind: Demonstrations in graphical authentication. In PattersonW. (Ed.), New perspectives in behavioral cybersecurity II (pp. 14–29). CRC Press.
23.
StillJ. D.TillerL. N. (2021). Exploring understanding and usage of two-factor authentication account recovery (pp. 223–231) [Conference session]. Proceedings of the 7th International Conference on Human Factors in Cybersecurity, Virtual Conference.
24.
TulvingE.ThomsonD. M. (1973). Encoding specificity and retrieval processes in episodic memory. Psychological Review, 80, 352–373.
25.
van MarleK.SchollB. J. (2003). Attentive tracking of objects versus substances. Psychological Science, 14, 498–504.
26.
WiedenbeckS.WatersJ.SobradoL.BirgetJ. C. (2006). Design and evaluation of a shoulder-surfing resistant graphical password scheme [Conference session]. Proceedings of the Working Conference on Advanced Visual Interfaces, New York, NY, USA (pp. 177–184).
27.
ZimmermannV.SchöniL.SchalteggerT.AmbuehlB.KniepsM.EbertN. (2024). Human-centered cybersecurity revisited: From enemies to partners. Communications of the ACM, 67(11), 72–81.
