6 Concluding Remarks
Our results suggest that a user's tendency to recall certain types of images may aid an attacker in creating a graphical dictionary for dictionary attacks against the DAS scheme. If or when graphical passwords become commonly used, this information could be used (as is textual dictionary information) in recommending password lengths and properties for graphical password users, and in performing proactive graphical password checking [28]. Studies on how users actually do use graphical password schemes would result in even more specific recommendations.
Although this analysis examines the memorability of DAS passwords from the view of the visual and temporal structure of the drawing, it does not consider other factors of DAS passwords that may affect memorability. One such factor is the number of coordinates and strokes that people can recall when given enough time (recall §5). It is unknown whether the numbers cited for the number of coordinates people recall are a function of the time given to examine the pattern. Based on our class of memorable graphical passwords, we can guess what sort of images people are likely to draw; the complexity of these images in terms of password length or number of strokes is a separate issue.
Another factor one may expect to affect memorability of a password is the temporal order of the drawing. It is still unclear as to whether the memorability benefits of pictures would be distorted due to the need to not only recall the visual image associated with the picture, but the order in which it must be input. If the temporal order is a complicating factor that adds significant complexity to what users must recall, they may be more likely to choose single-stroke (or fewer-stroke) passwords. This could also be used to an attacker's advantage, providing an improvement to the graphical dictionary of mirror symmetric graphical passwords. A conservative variation of this concept was used in our graphical dictionaries: we assumed that users would use symmetry in both a local and global scope, local being the actual stroke drawn, global being the relationship between the strokes to be a symmetric password when viewed as a whole.
We believe that this work provides a significant extension to the analysis of graphical passwords -- it shows promise for the security of graphical passwords and gives incentive for their further study.
This work has also raised many new and interesting questions for how to pursue research in this area (see §5), suggesting there is much room for future work, in graphical password security and in related psychological studies. Psychological studies that allow a subject unlimited or a reasonably bounded time to memorize a dot sequence or grid drawing would be useful. The results could be examined for an upper bound on how the number of dots or complexity of the drawing could affect the memorability of the pattern, and thus what password lengths people are likely to choose. Similarly, psychological studies on how temporal order affects memorability of dot patterns or grid drawings would be useful in determining the type and length of strokes people will use within their password. Studies to show how grid size affects the memorability of drawings and what sort of graphical passwords users choose in practice would be helpful. Finally, extensions or alternatives to the DAS encoding scheme may improve security by increasing the size of the resulting password space.