A graphical password or graphical user authentication is a form of
authentication
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicatin ...
using
images rather than
letters
Letter, letters, or literature may refer to:
Characters typeface
* Letter (alphabet), a character representing one or more of the sounds used in speech; any of the symbols of an alphabet.
* Letterform, the graphic form of a letter of the alphabe ...
,
digits, or
special characters
As of Unicode version 15.0, there are 149,186 characters with code points, covering 161 modern and historical scripts, as well as multiple symbol sets. This article includes the 1062 characters in the Multilingual European Character Set 2 (MES ...
. The type of images used and the ways in which users interact with them vary between implementations.
Content types and mechanisms
Image sequence
Graphical passwords frequently require the user to select images in a particular order or respond to images presented in a particular order.
[
]
Image-generated text
Another graphical password solution creates a one-time password
A one-time password (OTP), also known as a one-time PIN, one-time authorization code (OTAC) or dynamic password, is a password that is valid for only one login session or transaction, on a computer system or other digital device. OTPs avoid seve ...
using a randomly generated grid of images. Each time the user is required to authenticate, they look for the images that fit their pre-chosen categories and enter the randomly generated alphanumeric character that appears in the image to form the one-time password.[
]
Facial recognition
One system requires users to select a series of face
The face is the front of an animal's head that features the eyes, nose and mouth, and through which animals express many of their emotions. The face is crucial for human identity, and damage such as scarring or developmental deformities may aff ...
s as a password, utilizing the human brain
The human brain is the central organ (anatomy), organ of the human nervous system, and with the spinal cord makes up the central nervous system. The brain consists of the cerebrum, the brainstem and the cerebellum. It controls most of the act ...
's ability to recall faces easily.[
]
Draw-a-Secret (DAS)
Draw-a-Secret is a type of graphical password that requires the user to draw a picture over a grid. The user must exactly remember the user-drawn gestures in order to be authenticated. A larger stroke count corresponds with an increase in security since it is harder for an attacker to copy the strokes and the order in which they are performed.
Weaknesses
When not used in a private setting, graphical passwords are typically more susceptible than text-based passwords to "shoulder-surfing attacks", in which an attacker learns the password by watching the screen as a user gains access.
References
{{reflist, refs=
[Butler, Rick A. (2004-12-21]
Face in the Crowd
mcpmag.com. Retrieved on 2012-05-20.
searchsecurity.techtarget.com. Retrieved on 2012-05-20.[{{cite web , url=http://www.darkreading.com/authentication/security/client/showArticle.jhtml?articleID=228200140 , title=Images Could Change the Authentication Picture , author=Ericka Chickowski , publisher=Dark Reading , date=2010-11-03]
["Confident Technologies Delivers Image-Based, Multifactor Authentication to Strengthen Passwords on Public-Facing Websites">{{cite web , url=http://www.marketwire.com/press-release/Confident-Technologies-Delivers-Image-Based-Multifactor-Authentication-Strengthen-Passwords-1342854.htm , title=Confident Technologies Delivers Image-Based, Multifactor Authentication to Strengthen Passwords on Public-Facing Websites, date=2010-10-28]
[{{cite web, url=http://cups.cs.cmu.edu/soups/2011/proceedings/a6_Zakaria.pdf, last1=Zakaria, first1=Nur Haryani, last2=Griffiths, first2=David, last3=Brostoff, first3=Sacha, last4=Yan, first4=Jeff, title=Shoulder Surfing Defence for Recall-based Graphical Passwords, work=Symposium On Usable Privacy and Security (SOUPS) 2011, date=20 July 2011]
Password authentication