On the security of picture gesture authentication
Ziming Zhao, Gail‐Joon Ahn, Jeong-Jin Seo, Hongxin Hu · 2013
Computing devices with touch-screens have experi-enced unprecedented growth in recent years. Such an evolutionary advance has been facilitated by various ap-plications that are heavily relying on multi-touch ges-tures. In addition, picture gesture authentication has been recently introduced as an alternative login experience to text-based password on such devices. In particular, the new Microsoft Windows 8TM operating system adopts such an alternative authentication to complement tradi-tional text-based authentication. In this paper, we present an empirical analysis of picture gesture authentication on more than 10,000 picture passwords collected from over 800 subjects through online user studies. Based on the findings of our user studies, we also propose a novel at-tack framework that is capable of cracking passwords on previously unseen pictures in a picture gesture authen-tication system. Our approach is based on the concept of selection function that models users ’ password selec-tion processes. Our evaluation results show the proposed approach could crack a considerable portion of collected picture passwords under different settings. 1