Can graphical passwords keep us secure online?

Can graphical passwords keep us secure online?

People stink at text-based passwords. Is there a better way? What if we could simply tell a story only we know using pictures?

Humans are optimized for image and pattern recognition, not the alphabet. That's why we start children with picture books, rather than War and Peace.

But passwords are several layers of abstraction for humans. There are the abstract characters themselves, then arranging the letters, numbers, and punctuation, into a non-word pattern, and then remembering the pattern. Passwords are designed to NOT play to human strengths.

In the days of ASCII terminals and command line interfaces, passwords made some kind of sense. But today, the primary online interface is a graphically rich mobile device.

So why are we still stuck with alphanumeric passwords? That's the question asked by Ilesanmi Olade et. al in the paper SemanticLock: An authentication method for Mobile devices using semantically-linked images.

THE BIG IDEA

Instead of arranging arbitrary alphanumeric in a non-obvious -- and non-memorable -- string, start with a group of pictures and select some that tell a story that is meaningful and memorable to you. The story can be as simple as "I eat breakfast with coffee."

So when you unlock your phone, or, hopefully, a website, you just choose from a group of graphical icons to tell your story. Today's larger screens could accommodate 12-20 icons. As icons are used, other icons could take their place, expanding the number of possible combinations.

Here's a graphic from the paper to illustrate the concept:

SMUDGE ATTACKS

The techniques most similar to SemanticLock are pattern based. Users drag their finger over a grid in a pattern that they've created.

Pattern-based authentication is faster than PINs, but are vulnerable to smudge attacks, where the trail of finger grease on the screen reveals the locations. Location labels can be changed, so different patterns are required, but that sacrifices the speed advantage of pattern systems.

TEST RESULTS

The researchers tested SemanticLock against PIN and Pattern authentication. They found that while Pattern gave the fastest logins, and PINs the lowest error rate, the memorability of SemanticLock stories was far superior, with only 10 percent of test participants unable to remember their passwords, far lower than other methods.

THE STORAGE BITS TAKE

Researchers have been exploring graphical passwords for more than a decade. What is novel about this paper's approach is the focus on memorability through stories, which plays to human love of narrative.

This study underscores the importance of the industry's work with fingerprint and facial recognition. Biometrics definitely simplify the mobile device authentication problem.

But it also shows how much more device vendors could do to replace passwords. What good are the best biometric authentication systems if they only get you to your phone's home page? Hello!