Source-linked AI summary
Shoulder Surfing attack in graphical password authentication
Arash Habibi Lashkari, Samaneh Farmand, Dr. Omar Bin Zakaria, Dr. Rosli Saleh
TL;DR
Shoulder-surfing attacks can capture passwords through direct observation or recorded authentication sessions, motivating alternatives to conventional text passwords. The paper examines graphical and pass-thought approaches, reporting resistant designs alongside usability findings and unresolved implementation and evaluation constraints.
Problem
Shoulder-surfing can expose passwords entered in public, while graphical passwords may increase vulnerability despite improving memorability and usability.
Method
The paper surveys and describes graphical-password and pass-thought approaches, including gaze-based input, free-position drawing, and brain-signal authentication.
Results
The surveyed approaches report shoulder-surfing resistance, while one study found non-dictionary passwords were the most vulnerable configuration and data-entry method mattered for graphical passwords.
Takeaways & Limitations
Shoulder-surfing protection depends on authentication design and attack context, so secure and usable authentication may be possible without treating non-dictionary passwords as universally better.
Takeaways & Limitations
Pass-thought authentication still has unresolved signal-recording and translation accuracy issues, while shoulder-surfing evidence needs studies using real attackers, environments, and long-term training effects.
Abstract
from arXiv · showhide
Information and computer security is supported largely by passwords which are the principle part of the authentication process. The most common computer authentication method is to use alphanumerical username and password which has significant drawbacks. To overcome the vulnerabilities of traditional methods, visual or graphical password schemes have been developed as possible alternative solutions to text based scheme. A potential drawback of graphical password schemes is that they are more vulnerable to shoulder surfing than conventional alphanumeric text passwords. When users input their passwords in a public place, they may be at risk of attackers stealing their password. An attacker can capture a password by direct observation or by recording the individuals authentication session. This is referred to as shouldersurfing and is a known risk, of special concern when authenticating in public places. In this paper we will present a survey on graphical password schemes from 2005 till 2009 which are proposed to be resistant against shoulder surfing attacks.
II. SHOULDER SURFING
The survey reviews graphical-password approaches intended to resist shoulder surfing, where attackers capture passwords by observing or recording authentication sessions. Across schemes, stronger resistance often involves usability or deployment trade-offs, while empirical findings show that input configuration and interaction design materially affect vulnerability.
- Graphical-password systems remain insufficiently mature because evidence for memorability and security is limited and their vulnerabilities are not fully understood.
- Promising alternatives include pass-thoughts, QDAS, and other graphical designs, but unresolved technical uncertainty, ecological-validity questions, and hardware requirements constrain adoption.
- Graphical-password research targets shoulder surfing, an attack in which passwords are captured through direct observation or recorded authentication sessions.
- The CHC scheme let users authenticate without clicking password images directly, and novices entered and remembered passwords accurately, but authentication took longer.
- Passfaces entered through a keyboard were the most effective laboratory deterrent, while strong passwords were more vulnerable than participants expected.
- EyePassword used gaze to select on-screen keyboard inputs, achieving marginal additional time, keyboard-like error rates, and majority user preference.
III. COMPARISON TABLE
The study reports a comparison of graphical-password schemes addressing shoulder surfing, identifying twelve methodologies among the reviewed articles.
- Twelve methodologies were identified as overcoming shoulder-surfing attacks in graphical-password schemes.
- Table 1 summarizes the study’s results from sixteen articles on shoulder surfing.
IV. CONCLUSION
The paper reviews graphical-password designs resistant to shoulder surfing and concludes that proposed methods still require improvement. It also identifies future work to enhance a recognition-based algorithm.
- More than 30 graphical-password designs were studied, with 16 algorithms selected for resistance to shoulder surfing.
- The reviewed methods require both strong security and good usability, but existing shoulder-surfing solutions still need improvement.
- Future work proposes enhancing a recognition-based graphical-password algorithm to address scheme limitations.
- The study aims to support development of secure and usable graphical-authentication systems.