The graphical password schemes we considered in this study have the
property that the space of passwords can be exhaustively searched in
short order if an offline search is possible. So, any use of these
schemes requires that guesses be mediated and confirmed by a trusted
online system. In such scenarios, we believe that our study is the
first to quantify factors relevant to the security of user-chosen
graphical passwords. In particular, our study advises against the use
of a Passfaces
-like system that permits user choice of the password,
without some means to mitigate the dramatic effects of attraction and
race that our study quantifies. As already demonstrated, for certain
populations of users, no imposed limit on the number of incorrect
password guesses would suffice to render the system adequately secure
since, e.g., 10% of the passwords of males could have been guessed by
merely two guesses.
Alternatives for mitigating this threat are to prohibit or limit user choice of passwords, to educate users on better approaches to select passwords, or to select images less prone to these types of biases. The first two are approaches initially attempted in the context of text passwords, and that have appeared in some graphical password schemes, as well. The Story scheme is one example of the third strategy (as is [4]), and our study indicates that password selection in this scheme is sufficiently free from bias to suggest that reasonable limits could be imposed on password guesses to render the scheme secure. For example, the worst 10% of passwords in the Story scheme for the most predictable population (Asian males) still required twenty guesses to break, suggesting a limit of five incorrect password guesses might be reasonable, provided that some user education is also performed.
The relative strength of the Story scheme must be balanced against what appears to be some difficulty of memorability for users who eschew the advice of using a story to guide their image selection. An alternative (besides better user education) is to permit unordered selection of images from a larger set (c.f., [4,7]). However, we believe that further, more sizeable studies must be performed in order to confirm the usability and security of these approaches.