Graphical User Authentication: A Comparative Evaluation of Composite Scene Authentication vs. Three Competing Graphical Passcode Systems

Abstract

Previous studies (Johnson & Werner, 2006; 2007) have shown that Composite Scene Authentication (CSA) passcodes are more memorable than alphanumeric passwords over extended retention intervals. This study evaluated the memorability of six types of graphical passcodes of varying complexity (including three variants of CSA passcodes) over thirty-minute and one-week retention intervals. The graphical passcodes were compared to one another, as well as to an alphanumeric password of equivalent bit length. A strong overall advantage in information retained was found for graphical passcodes (M = 92.83%) compared to alphanumeric passwords (M = 75.47%). In addition, CSA passcodes were remembered better (M = 97.1 %) than other graphical passcodes (M = 88.56%). An even larger difference was observed for percent successful logins for CSA passcodes (M = 84.23%) compared to other graphical passcodes (M= 56.39%) after the one-week retention interval. The variable bit lengths of the passcodes did not affect percent information retained.

Get full access to this article

View all access options for this article.

References

Adams

Sasse

M. A.

Users are not the enemy. (1999). Communications of the ACM, 42(12), 41–46.

Adams

Sasse

M. A.

Lunt

(1997) Making passwords secure and usable. In Thimbleby

O'Connail

Thomas

(eds), People and Computers XII: Proceedings of HCI 1997, 1–19.

De Angeli

Coventry

Johnson

Renaud

(2005). Is a picture really worth a thousand words? Exploring the feasibility of graphical authentication systems. International Journal of Human Computer Studies, 63, 128–152.

Dhamija

Perrig

(2000). Déjà vu: A user study using images for authentication. In Proceedings of the 9th USENIX Security Symposium, Denver, Colorado.

Henry

(n. d.) A ramble in aphasia. Retrieved online May, 2006 from http://www.literaturecollection.com/a/;o_henry/195/.

Jermyn

Mayer

Monrose

Reiter

M. K.

Rubin

(1999). The design and analysis of graphical passwords. In Proceedings of the 8th USENIX Security Symposium, Washington, D.C.

Johnson

Werner

(2006). Using Composite scene authentication (CSA) as a graphical alternative to alphanumeric password systems. In Proceedings of the 50th annual meeting of the Human Factors and Ergonomics Society. San Francisco, CA.

Johnson

Werner

(2007). Memorability of alphanumeric and Composite Scene Authentication (CSA) passcodes over extended retention intervals. In Proceedings of the 51st annual meeting of the Human Factors and Ergonomics Society. Baltimore, MD.

Nisbett

R. E.

Wilson

T. D.

(1977). The halo effect: Evidence for unconscious alteration of judgments. Journal of Personality and Social Psychology, 35(4), 250–256.

10.

Passfaces Corporation (2005). Passfaces™ web access. Retrieved November, 14, 2006 from http://www.passfaces.com/products/webaccess.htm.

11.

Renaud

De Angeli

(2004). My password is here An investigation into visuo-spatial authentication mechanisms. Interacting With Computers, 16, 1017–1041.

12.

Standing

(1973). Learning 10, 000 pictures. Quarterly Journal of Experimental Psychology, 25(2), 207–222.

13.

Wiedenbeck

Waters

Birget

J. C.

Brodskiy

Memon

(2005). PassPoints: Design and longitudinal evaluation of a graphical password system. International Journal of Human-Computer Studies, 63, 102–127.