Investigating gesture-based password: usability and vulnerability to shoulder-surfing attacks

The recognition-based password such as graphical passwords provides great potential to reduce the memory load for the user. In addition, graphical passwords provide a security benefit over dictionary attacks compared to traditional alphanumeric passwords. However, the graphical passwords inhibit several well-known limitations such as vulnerability to shoulder-surfing attacks. We developed a gesture-based password and conducted a user study to evaluate the usability of this password as well as the impact of shoulder-surfing attacks. The result suggests that users can easily learn the new password method. Although difference was detected between authenticated entries and unauthenticated entries in features such as confidence scores, the classification accuracy of the preliminary machine learning analysis is not high. We will include more features and explore other machine learning techniques in our future studies.