Even or Odd: A Simple Graphical Authentication System

Abstract

Many portable devices need a simple authentication system to protect them from being used by an unauthenticated person such as a thief. The security of traditional methods such as pin codes or passwords is limited by shoulder surfing where a casual or intentional observer observes an authentication session and derives all information necessary for authentication. Graphical authentication systems have been developed to forestall this attack. We present here an especially simple variant of a graphical authentication system based on the capacity of humans to recognize faces well. In our challenge-response scheme, a user is presented with a row of typically three faces and needs to decide whether the number of “friends” is even or odd. We present here an analysis of security and usability of this scheme.