|
13th USENIX Security Symposium — Abstract
Pp. 135–150 of the Proceedings
Graphical Dictionaries and the Memorable Space of Graphical Passwords
Julie Thorpe and Paul van Oorschot, Carleton University
Abstract
In commonplace textual password schemes, users choose passwords that are
easy to recall. Since memorable passwords typically exhibit patterns, they are
exploitable by brute-force password crackers
using attack dictionaries. This leads us to ask
what classes of graphical passwords users find memorable.
We postulate one such class
supported by a collection of cognitive studies on visual recall,
which can be characterized as mirror symmetric (reflective) passwords.
We assume that an attacker would put this class in an
attack dictionary for graphical passwords and propose how an attacker
might order such a dictionary.
We extend the existing analysis of graphical passwords by analyzing the size
of the mirror symmetric password space relative to
the full password space of the graphical password scheme
of Jermyn et al. (1999), and show it to be exponentially
smaller (assuming appropriate axes of reflection).
This reduction in size can be compensated for by longer passwords:
the size of the space of mirror symmetric passwords of length
about L+5 exceeds that of the full password
space for corresponding length L ≤ 14 on a 5 ~ 5 grid.
This work could be used to help in
formulating password rules for graphical password users and in creating
proactive graphical password checkers.
- View the full text of this paper in HTML and PDF.
Until August 2005, you will need your USENIX membership identification in order to access the full papers. The Proceedings are published as a collective work, © 2004 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
|
Need help? Use our Contacts page.
