Shoulder-surfing Resistance Research Articles

A Comparison of a Touch-Gesture- and a Keystroke-Based Password Method: Toward Shoulder-Surfing Resistant Mobile User Authentication

The pervasive use of mobile devices exposes users to an elevated risk of shoulder-surfing attacks. Despite the prior work on shoulder-surfing resistance of mobile user authentication methods, there is a lack of empirical studies on textual password authentication methods, particularly the hybrid passwords that integrate textual passwords with biometrics. To fill the literature gap, this research compares two hybrid password methods, touch-gesture- and keystroke-based passwords, with respect to their shoulder-surfing resistance performance. We select a touch-gesture-based password method that deploys multiple shoulder-surfing resistance strategies and a keystroke-based password method that leverages keystroke dynamics. To gain a holistic understanding of these password methods, we examine them under a variety of shoulder-surfing settings by varying interaction mode, observation angle, entry error, and observation effort. Going beyond effectiveness metrics, we also introduce efficiency metrics to assess shoulder-surfing resistance performance more comprehensively. We hypothesize and test the effects of shoulder-surfing settings by conducting both a longitudinal lab experiment and an online experiment with diversified participants. The results of both studies demonstrate the superior performance of the touch-gesture-based password method to the keystroke-based counterpart. The results also provide evidence for the effects of interaction mode, observation angle, and observation effort on shoulder-surfing resistance of hybrid passwords. Our findings offer suggestions for the design and strategies for strengthening the security of password authentication methods.

Shoulder Surfing Attack Trusted Verification – A Survey

Individual performance such as select a mistaken code word or inflowing a code word in an unsure of yourself manner result in the easiest linkage in authentication. An invader is able to harm the hardware, software, or information by exploiting the weakest link. As a result, our goal is to give a elegant method for users to validate their bank accounts. In computer or IT security, authentication-based passwords are used. As an alternative of using alphanumeric as a code word, the user is able to choose to use an image as a password. The customer is capable of depicting the shoulder surfing attack using the mobile application. Passwords can be observed by attackers using spyware or shoulder surfing. To solve the problem, the Pass Matrix authentication system is proposed, which is based on graphical passwords and can withstand a shoulder surfing attack. Pass Matrix does not provide any suggestion or stature, still when conducting camera-based attacks, through a just the once suitable login display and navigation button cover the whole range of pass-image. As a result, the future system outperforms the competition in provisos of shoulder surfing resistance.

RoundPIN: Shoulder Surfing Resistance for PIN Entry with Randomize Keypad

The security of a PIN is largely supported by the authentication process in ATM. Most authentication methods like traditional are based on using PIN as direct entry and this technique has been shown lots of drawbacks such as vulnerability to password space, and shoulder-surfing. In this paper, a new approach is proposed called RoundPIN depends on the appearance of the numerical password through one of the buttons after selecting it by the user and it is done through a number of rounds, the numbers are arranged randomly on the keypad. Due to the variable aspect of the chosen button and the random appearance of the numbers in each connection session and also the selection process will take place through three buttons three auxiliary, the proposed approach can maintain high secure session to enter the PIN to resist shoulder surfing, which is difficult for attackers to observe a user's PIN. The performance evaluation of the proposed approach is achieved in two parts, the first one is based on security analysis. Then a pilot study of thirty users is conducted to evaluate the useability of the proposed approach. It is noticed that the proposed approach can maintain a high level of security as well as acceptable level of useability and user satisfaction compared the conventional keypad system.

Usability and shoulder surfing vulnerability of pattern passwords on mobile devices using camouflage patterns

With the revolution of smart devices that have become the basis of our daily lives, the majority of users rely on them to save their personal and sensitive information. As a result, users are increasingly interested in authentication processes, which is a challenge for designers to provide a secure and usable authentication process. The pattern password is one of the most selected authentication methods, since the recent development in alternative authentication interfaces for smart phones, tablets and touch screens laptops. Although drawing a pattern seems easier than typing a password, it has a major security drawback which is the shoulder-surfing attack. Therefore, this paper proposes a shoulder-surfing resistance approach for mobile devices using Camouflage Patterns method which allows choosing a very short password, while insuring that the password remains hidden amongst a large number of nodes draws. Based on this approach, three techniques are introduced and implemented using an Android platform. An experimental study is conducted for evaluating the security and usability aspects. The results showed that the proposed approach is reasonably resistant against shoulder-surfing attacks and usable for users. Accordingly, this approach is recommended for designers in order to provide very simple and yet very complicated passwords, to be observed by the attacker, at the same time.

Personal Identification with Any Shift: Authentication method for smartwatches having shoulder-surfing resistance

Personal Identification with Any Shift: Authentication method for smartwatches having shoulder-surfing resistance

Examination of personal authentication method achieving shoulder-surfing resistance by combining mouse operation and number matrix

Examination of personal authentication method achieving shoulder-surfing resistance by combining mouse operation and number matrix

A Survey of Password Schemes in Different Contexts

We conduct user surveys to investigate user preferences on password schemes for mobile devices. By preforming face-to-face interviews with several individuals and testing several hypotheses, we were able to provide insight on end users and their views on where password schemes should be used. The investigation also indicates that users value access speed and minimal gestures over security and memorability. Through the surveys, we also find out users are not caring about shoulder-surfing attacks although the shoulder-surfing resistance is one of the major research topics on security. The surveys also show strong interest from users to protect individual applications with password schemes.

Implementation and user testing of personal authentication having shoulder surfing resistance with mouse operations

Implementation and user testing of personal authentication having shoulder surfing resistance with mouse operations

A Survey Paper on Authentication for Shoulder Surfing Resistance for Graphical Password using Cued Click Point (CCP)

A Survey Paper on Authentication for Shoulder Surfing Resistance for Graphical Password using Cued Click Point (CCP)

Evaluating the Usability and Security of Input Masking Techniques

The human remains the weakest link in computer security, and one popular method of breaching security is shoulder surfing: looking at a user’s screen or keyboard as he or she enters sensitive input. Various masking techniques exist to hide text from shoulder surfers; the most common of these replaces entered text with bullets. Existing research focuses on how to improve the shoulder surfing resistance of bulletmasking, at a heavy cost to usability. We developed Purloin: an input masking technique designed to maintain the same level of security while increasing usability. We recruited pairs of participants (filling both user and shoulder surfer roles) and tested five different masking techniques on objective measures of usability and security, subjective measures of usability and workload, and user preference. We found that Purloin performed near the top in both usability and security and received the highest overall preference ranking. Bullet-masking was equally secure but less usable. The other masking t...

Shoulder Surfing Resistance Using PENUP Event And Neighboring Connectivity Manipulation

Picture-based password has been proposed as an alternative authentication method to replace text-based password. Ensuring the security of picture-based password is not a simple task as picture-based objects are a lot easier to access and remember and can thus be easily guessed. In particular, shoulder surfing attack still remains as the main security threat encountered by many picture-based password authentication schemes, especially in drawmetric authentication scheme. In this paper, a novel shoulder surfing resistance mechanism has been proposed and evaluated. The proposed mechanism utilises penup event and neighbouring connectivity manipulation into a revised Background Pass-Go scheme. From the evaluation result, it has proven that the proposed mechanism achieves better results in resisting shoulder surfing attack while, at the same time, allowing a larger password space.