Abstract

Passwords are the almost universal authentication mechanism, even though they are basically flawed and cause problems for users due to poor memorability. Graphical methods of authentication have recently excited some interest but little is known about their actual efficacy. There are basically two types of graphical authentication mechanisms: recognition-based and location-based—also called visuo-spatial mechanisms. Whereas some kinds of recognition-based graphical authentication mechanisms have been evaluated by various researchers, there is still a need to investigate location-based graphical authentication mechanisms in a more rigorous fashion to determine whether they could be a viable alternative to traditional passwords for web usage. This paper discusses graphical authentication mechanisms in general and reports on the evaluation of one particular visuo-spatial mechanism, aimed at augmenting the password paradigm by providing a way to record passwords securely. Results and findings are presented, and conclusions drawn, some of which can also be applied to other types of visuo-spatial mechanisms. We also propose a set of metrics which can be used to measure the quality of web authentication mechanisms and apply these to a range of existing authentication mechanisms.

Keywords: User authentication; Graphical mechanisms; Visuo-spatial memory; Evaluation; Web authentication; Metrics

Article Outline

1. Introduction

2. Authentication mechanisms

2.1. Biometrics

2.2. Passwords

2.3. Graphical authentication

2.3.1. Recognition-based systems

2.3.2. Location-based systems

3. Jiminy: assessing location memory

3.1. Pilot study

3.1.1. Results

3.1.2. Discussion

3.1.3. Predicting location choice

4. Web-based evaluation

4.1. Image choice

4.2. Hypothesis

4.3. Method

4.3.1. Participants

4.3.2. Procedure

4.3.3. Design

4.4. Results

4.5. Discussion

5. Visuo-spatial mechanisms and the essential criteria

6. Conclusions

Acknowledgements

References