Shoulder Surfing Research Articles

PrivacyScout: Assessing Vulnerability to Shoulder Surfing on Mobile Devices

One approach to mitigate shoulder surfing attacks on mobile devices is to detect the presence of a bystander using the phone’s front-facing camera. However, a person’s face in the camera’s field of view does not always indicate an attack. To overcome this limitation, in a novel data collection study (N=16), we analysed the influence of three viewing angles and four distances on the success of shoulder surfing attacks. In contrast to prior works that mainly focused on user authentication, we investigated three common types of content susceptible to shoulder surfing: text, photos, and PIN authentications. We show that the vulnerability of text and photos depends on the observer’s location relative to the device, while PIN authentications are vulnerable independent of the observation location. We then present PrivacyScout – a novel method that predicts the shoulder-surfing risk based on visual features extracted from the observer’s face as captured by the front-facing camera. Finally, evaluations from our data collection study demonstrate our method’s feasibility to assess the risk of a shoulder surfing attack more accurately.

An Enhanced Security Model for Simple Reformation-Based Password Scheme using PHP

Lack of security has become a major concern, given the prevalence of attackers, hackers, crackers, scammers and spammers. A key area in security research and practice is authentication, the determination of whether a user should be allowed to access a given system or resource. Existing authentication processes are usually accomplished by user ID and password, with the authentication schemes Pair-based Authentication scheme based. Textual passwords are the most common method used for authentication. But textual passwords are vulnerable to eves dropping, dictionary attacks, social engineering and shoulder surfing. Graphical passwords are introduced as alternative techniques to textual passwords. Most of the graphical schemes are vulnerable to shoulder surfing. To address this problem, text can be combined with images or colors to generate session passwords for authentication. Session passwords can be used only once and every time a new password is generated. In this research paper, two different techniques are proposed to generate session passwords using text and colors which are resistant and more secured. These methods are suitable for Personal Digital Assistants. These methods are suitable for Personal Digital Assistants. This scheme can authenticate the user by session passwords that are used only once. It is no longer useful if the session is terminated. For every login process, users have to feed the input with different passwords. It provides better security against dictionary and brute force attacks as password changes for every session. The proposed authentication schemes use text, colors and images for generating session passwords.

Innovative Color Band Security System to Avoid Shoulder Surfing

Conventional password schemes are greatly at risk of shoulder surfing, many shoulder surfing graphical way schemes are created. But, end users are more acquainted with textual password than pure graphical password, text-based graphical password schemes are proposed. Sadly, none of the text-based shoulder surfing resistant graphical password schemes is both secure and efficient enough right now. In this paper, it proposed an enhanced version of text-based shoulder surfing resistant graphical password using your favourite color. In this proposed scheme, the user can easily and efficiently login in the system. Next, we analyze the protection and usefulness of the proposed scheme, and show the resistance of the proposed scheme to shoulder surfing and accidental login. The shoulder surfing attack is an attack in which attacker try get the user’s password by watching over the user’s shoulder as he enters his password. As conventional password schemes are prone to shoulder surfing, Bravado and Biretta proposed three shoulder surfing resistant graphical password schemes. Since then, many graphical password schemes with different degrees of resistance to shoulder surfing are proposed and every has its pros and cons. The alphabet utilized in the proposes scheme contains 16 characters, including 8 small letter alphabets from a to h & 8 numerical from 1-8.

Secure Data Access using Steganography and Image Based Password

Technology has developed to a very great extent, and the use of smart systems has introduced an increasing threat to data security and privacy. Most of the applications are built-in unsecured operating systems, and so there is a growing threat to information cloning, forging tampering counterfeiting, etc. This will lead to an un-compensatory loss for end-users particularly in banking applications and personal data in social media. The shoulder surfing attack in an assault that can be achieved with the aid of the adversary to accumulate the individual’s password by way of searching over the client’s shoulder as he enters his password. As conventional password schemes are vulnerable to Shoulder Surfing, Steganography and Cryptography proposed three shoulder surfing resistant graphical password schemes. However, most of the current graphical password schemes is liable to shoulder-browsing a recounted hazard wherein an attacker can seize a password by means of way of direct statement or by recording the authentication consultation. Because of the visual interface, shoulder-browsing becomes an exacerbated problem in graphical passwords. A graphical password is easier than a textual content-based password for the majority to undergo in thoughts. Suppose an eight-man or woman password is critical to benefit access into a specific computer network. Sturdy passwords may be produced which might be proof against guessing, dictionary assault. Key-loggers, shoulder surfing and social engineering. Graphical passwords have been utilized in authentication for mobile phones, ATM machines, E-transactions.

User-centred multimodal authentication: securing handheld mobile devices using gaze and touch input

ABSTRACT Handheld mobile devices store a plethora of sensitive data, such as private emails, personal messages, photos, and location data. Authentication is essential to protect access to sensitive data. However, the majority of mobile devices are currently secured by singlemodal authentication schemes which are vulnerable to shoulder surfing, smudge attacks, and thermal attacks. While some authentication schemes protect against one of these attacks, only few schemes address all three of them. We propose multimodal authentication where touch and gaze input are combined to resist shoulder surfing, as well as smudge and thermal attacks. Based on a series of previously published works where we studied the usability of several user-centred multimodal authentication designs and their security against multiple threat models, we provide a comprehensive overview of multimodal authentication on handheld mobile devices. We further present guidelines on how to leverage multiple input modalities for enhancing the usability and security of user authentication on mobile devices.

Graphical Password Authentication System

Abstract: Graphical password is one of technic for authentication of computer security. Now days digital/computer security is most important things in computer science for protected user or customer data. And Shoulder-surfing is a one of the threats where a criminal can steal a password by direct observation or by recording the authentication session. There are several techniques available for this authentication, the most prevalent and simple of which is the Graphical password technique. So, we suggest a new technique to combat this problem. We have developed two concepts to combat shoulder surfing attacks. First, the user must register if the registration does not exist. Second, you must log in with a valid user ID and password. The password is a grouping of characters and numbers. Third, user has to cross image-based authentication where user can choose their password and this method have higher chances to offset each other. You should choose password according to the registration password, it must to match at login time. In colour base authentication, there should be several colour base passwords and depending on the colour, you need to remember the password sequence. And it’s like three-factor authentication. So, here is proposed a new graphical password authentication technique that is resilient to shoulder surfing and also to other types of probable attacks. Keyword: Computer Authentication, Graphical Password, Computer security

Shoulder Surfing Attack Trusted Verification – A Survey

Individual performance such as select a mistaken code word or inflowing a code word in an unsure of yourself manner result in the easiest linkage in authentication. An invader is able to harm the hardware, software, or information by exploiting the weakest link. As a result, our goal is to give a elegant method for users to validate their bank accounts. In computer or IT security, authentication-based passwords are used. As an alternative of using alphanumeric as a code word, the user is able to choose to use an image as a password. The customer is capable of depicting the shoulder surfing attack using the mobile application. Passwords can be observed by attackers using spyware or shoulder surfing. To solve the problem, the Pass Matrix authentication system is proposed, which is based on graphical passwords and can withstand a shoulder surfing attack. Pass Matrix does not provide any suggestion or stature, still when conducting camera-based attacks, through a just the once suitable login display and navigation button cover the whole range of pass-image. As a result, the future system outperforms the competition in provisos of shoulder surfing resistance.

A Hybrid Graphical User Authentication Scheme in Mobile Cloud Computing Environments

User authentication is a critical security requirement for accessing resources in cloud computing systems. A text-based password is a standard user authentication way and it is still extensively used so far. However, textual passwords are difficult to remember, which forces users to write it down and compromise security. In recent years, graphical user authentication methods have been proposed as an alternative way used to verify the identity of users. The most critical challenges cloud-computing users face is to post their sensitive data on external servers that are not directly under their control and that can be used or managed by other people. This paper proposes a question-based hybrid graphical user authentication scheme for portable cloud-computing environments. The proposed scheme comprises advantages over both recognition- and recall-based techniques without storing any sensitive information on cloud servers. The experimental study and survey have been conducted to investigate the user satisfaction about the performance and usability aspects of the proposed scheme. The study results show that the proposed scheme is secure, easy to use, and immune to potential password attacks such as brute force password guessing attacks and shoulder surfing attacks

Improving memorability using Emojis in a shoulder surfing resistant authentication method

Background: Emojis are icons that are familiar and fun to add pizzazz and colour to communication. They have also been used in authentication where the emojis form memorable pictogram story-like passwords. Emojis, which are graphical, are in general vulnerable to shoulder surfing attacks (SSAs). This paper studies whether graphics such as emojis offer better memorability than numerics when implemented in a shoulder-surfing resistant authentication method. Thus, the proposed method aims to meet both needs of being shoulder-surfing resistant as well as being memorable. Methods: In this paper, a SSA resistant method (DragPIN) is used as a reference system on which to implement emojis in place of numerics. Additionally, a new feature, cue questions was implemented for added security. In the proposed method, users composed emoji-based stories using personalised cue questions that served as memory aids. Moreover, these self-chosen cue questions were less comprehensible to shoulder-surfing observers. There were two variants of the DragPIN method, manual and automatic-sliding. To compare the differences, both the reference configuration and modified versions based on the proposed method were implemented. Thirty people participated in user testing. A pre- and post-survey appraised user experience. User testing and survey on both methods and their variants for performance, memorability, and usability were performed. Results: All implementations successfully resisted shoulder surfing. The time taken for login in the manual variant using the proposed methodology was shorter than using the reference method. After four to six weeks, login performance taking into account intermediate failures was better for the proposed method (86.7-91.7%) than the reference method (76.7-78.3%). Hypothesis testing also showed significance in the results. This could point to higher memorability in the proposed method. Conclusion: The study provides testing of emoji-based compared to PIN-based implementation in authentication. Emoji-based stories may form memorable passwords while personalised cue questions may aid memorability.

Passnumbers: An Approach of Graphical Password Authentication Based on Grid Selection

The authentication textual passwords are the most widely used technique. However, this type of legacy authentication is vulnerable to various attacks, such as shoulder-surfing attacks. Hence, graphical password authentication is one of these approaches which has been suggested to overcome the issues related to textual passwords. Nevertheless, the hackers have also developed new techniques that can be finally broken the graphical password, for instance, listening to the transmitted information between the client and the server. In this paper, Passnumbers graphical authentication password is proposed. Passnumbers approach involves two new stages, which are first, using the coordinates of a graphical grid cells-based numbers for entering the password. The second stage is represented by deploying a new technique to encrypt the password based on the image pixels. The performance evaluation reveals that the proposed Passnumbers can provide high resistance against several graphical password attacks including shoulder surfing and eavesdropping attacks. Passnumbers is evaluated using several metrics including security and usability.

GRA-PIN: A Graphical and PIN-Based Hybrid Authentication Approach for Smart Devices.

In many smart devices and numerous digital applications, authentication mechanisms are widely used to validate the legitimacy of users’ identification. As a result of the increased use of mobile devices, most people tend to save sensitive and secret information over such devices. Personal Identification Number (PIN)-based and alphanumeric passwords are simple to remember, but at the same time, they are vulnerable to hackers. Being difficult to guess and more user-friendly, graphical passwords have grown in popularity as an alternative to all such textual passwords. This paper describes an innovative, hybrid, and much more robust user authentication approach, named GRA-PIN (GRAphical and PIN-based), which combines the merits of both graphical and pin-based techniques. The feature of simple arithmetic operations (addition and subtraction) is incorporated in the proposed scheme, through which random passwords are generated for each login attempt. In the study, we have conducted a comparative study between the GRA-PIN scheme with existing PIN-based and pattern-based (swipe-based) authentications approaches using the standard Software Usability Scale (SUS). The usability score of GRA-PIN was analyzed to be as high as 94%, indicating that it is more reliable and user friendly. Furthermore, the security of the proposed scheme was challenged through an experiment wherein three different attackers, having a complete understanding of the proposed scheme, attempted to crack the technique via shoulder surfing, guessing, and camera attack, but they were unsuccessful.

IoT Devices Authentication Using Artificial Neural Network

User authentication is one of the critical concerns of information security. Users tend to use strong textual passwords, but remembering complex passwords is hard as they often write it on a piece of paper or save it in their mobile phones. Textual passwords are slightly unprotected and are easily attackable. The attacks include dictionary, shoulder surfing, and brute force. Graphical passwords overcome the shortcomings of textual passwords and are designed to aid memorability and ease of use. This paper proposes a Process-based Pattern Authentication (PPA) system for Internet of Things (IoT) devices that does not require a server to maintain a static password of the login user. The server stores user’s information, which they provide at the time of registration, i.e., the R-code and the symbol, but the P-code, i.e., the actual password, will change with every login attempt of users. In this scheme, users may draw a pattern on the basis of calculation from the P-code and R-code in the PPA pattern, and can authenticate themselves using their touch dynamic behaviors through Artificial Neural Network (ANN). The ANN is trained on touch behaviors of legitimate users reporting superior performance over the existing methods. For experimental purposes, PPA is implemented as a prototype on a computer system to carry out experiments for the evaluation in terms of memorability and usability. The experiments show that the system has an effect of 5.03% of the False Rejection Rate (FRR) and 4.36% of the False Acceptance Rate (FAR), respectively.

New Textual Authentication Method to Resistant Shoulder-Surfing Attack

Using textual passwords suffer from the balance between security and usability. Password policies are usually adopted by system administrators to force users to choose strong passwords. However, users often use a simple password to make it easy to remember, which reduces the password strength and make it vulnerable to information security threats. When users enter their passwords in public places like airports or cafes, they become exposed to shoulder surfing attacks which are considered as a kind of social engineering. With a little effort, an attacker can capture a password by recording the individual’s authentication session or by direct observation. To overcome this vulnerability, we propose a new textual-password approach that uses camouflage characters and a virtual keyboard which leads to generating strong and easy to remember passwords. The perspective of usability and security was evaluated by experimental studies conducted with 65 users and then compared with recent studies. The results showed that the proposed technique has the lowest shoulder surfing success rate with just 3.63% with reasonable usability.

RoundPIN: Shoulder Surfing Resistance for PIN Entry with Randomize Keypad

The security of a PIN is largely supported by the authentication process in ATM. Most authentication methods like traditional are based on using PIN as direct entry and this technique has been shown lots of drawbacks such as vulnerability to password space, and shoulder-surfing. In this paper, a new approach is proposed called RoundPIN depends on the appearance of the numerical password through one of the buttons after selecting it by the user and it is done through a number of rounds, the numbers are arranged randomly on the keypad. Due to the variable aspect of the chosen button and the random appearance of the numbers in each connection session and also the selection process will take place through three buttons three auxiliary, the proposed approach can maintain high secure session to enter the PIN to resist shoulder surfing, which is difficult for attackers to observe a user's PIN. The performance evaluation of the proposed approach is achieved in two parts, the first one is based on security analysis. Then a pilot study of thirty users is conducted to evaluate the useability of the proposed approach. It is noticed that the proposed approach can maintain a high level of security as well as acceptable level of useability and user satisfaction compared the conventional keypad system.

Attacks on Graphical Password: A Study on Defense Mechanisms and Limitations

User authentication is mostly reliant on password-based based verification. Users generally used text-based passwords, which are user-friendly but often predictable and vulnerable to some common attacks. To overcome these shortcomings, graphical authentication methods have emerged. Here, users choose a sequence of images as passwords. Though such methods help users to better remember their passwords, they too suffer from attacks seen in the case of textual passwords. This paper presents a comprehensive summary of the vulnerabilities state of the art graphical password schemes against the following well-known attacks - Dictionary, Guessing, Brute force, Shoulder surfing, Spyware, and Social engineering. We believe the findings of this study can help researchers design more secure graphical password schemes making them more usable and a realistic replacement for text-based passwords.

Survey On Biometric Based ATMs

Nowadays Automated Teller Machines (ATMs) are widely used by people. People are dependent upon ATMs to conveniently meet their day-to-day needs. As it is an important factor there comes security. ATMs are electronic machines that are operated by customers to deposit or withdraw cash from banks. It is observed that the number of crimes related to ATMs is increased hence there is a need to provide better security to ATM machines. There are different technologies that are used to provide security to ATM machine which includes – RFID technology, fingerprint, face recognition, iris scan, OTP, reference number, random keypad, etc. In a traditional ATM system card and PIN numbers are used for authentication, where security plays a big concern, such as losing cards, stolen pin numbers, card cloning, shoulder surfing, fake keyboard, skimming, etc. In order to overcome these issues, this paper discusses various systems where ATM cards and pins are replaced by biometrics and how they made ATMs more secure.

Enhanced Secure ATM authentication using NFC Technology and Iris Verification

In today's world technology has advanced to such an extent that it is interchangeable with connection and convenience. ATM was one of the major breakthroughs, and over the time it has provided better convenience in fulfilling one’s banking needs. Although, there are certain predicaments that such ATM transactions are susceptible too. The conventional PIN based authentication that is presently accustomed in all ATM apparatus is liable to shoulder surfing, hassle in remembering the multiple PIN and the rest. The physical card brings along setbacks in particular, wearing out of the magnetic strip attributable to frequent usage, losing or getting it stolen. Aside from these there are other unlawful activities that are carried upon. The objective of this paper is to present a solution to the above stated problems. In contrast to standard architecture, the proposed solution incorporates NFC enabled smartphones as a substitute for physical card and iris based authentication for PIN.

Web Application Authentication Using Visual Cryptography and Cued Clicked Point Recall-based Graphical Password

Alphanumerical usernames and passwords are the most used computer authentication technique. This approach has been found to have a number of disadvantages. Users, for example, frequently choose passwords that are simple to guess. On the other side, if a password is difficult to guess, it is also difficult to remember. Graphical passwords have been proposed in the literature as a potential alternative to alphanumerical passwords, based on the fact that people remember pictures better than text. Existing graphical passwords, on the other hand, are vulnerable to a shoulder surfing assault. To address this shoulder surfing vulnerability, this study proposes an authentication system for web-applications based on visual cryptography and cued click point recall-based graphical password. The efficiency of the proposed system was validated using unit, system and usability testing measures. The results of the system and unit testing showed that the proposed system accomplished its objectives and requirements. The results of the usability test showed that the proposed system is easy to use, friendly and highly secured.

A Two Factor Image Based Authentication System

In the world, mobile phone usage has increased rapidly in the world, resulting in more security issues and requiring security improvements. The data from the mobile phones are stolen or deleted from the mobile phones of the users. Even though their mobile phones are protected with device-in-built security, they can be easily cracked by shoulder surfing, random guessing, or brute force attack. The paper aims to protect the users from these problems by using Images with pattern-based security with Image CAPTCHA for Authentication. The user uses this application to set a graphical password by moving images in a matrix in a particular pattern, locking their data. The user has given different types of images, and the user has to select any three different images. Then the user has to draw the password for the selected image. This will enable the highest security to the mobile/web. By this risk of losing data will be less. It also has two-phase authentication security. When a user has to open the mobile/web, then the user has to enter any one of the passwords that the user has selected at the registration phase. After entering the password, the user has to click on the screen when he has chosen during the registration phase.

Scrambling Keypad for Secure Pin Entry to Defeat Shoulder Surfing and Inference Attacks

Personal identification number (PIN) is a common user authentication method widely used especially for automated teller machines and point-of-sales devices. The user's PIN entry is susceptible to shoulder-surfing and inference attacks, where the attacker can obtain the PIN by looking over the user's shoulder. The conventional keypad with a fixed layout makes it easy for the attacker to infer the PIN entered by casual observation. This paper proposes a method of authentication to address these challenges. The paper develops a prototype numeric keypad with a layout akin to the conventional keypad, with the keys randomized for each PIN entry. The shuffle algorithm, Durstenfeld shuffle algorithm, is implemented in an application developed using JavaScript, which is a prototype-based object-oriented programming application that conforms to the ECMAScript specification. The prototype is implemented on three computing platforms for evaluation. The test proves the effectiveness of the system to mitigate shoulder-surfing and inference attacks.