Abstract
Authentication based on passwords are largely used in applications for computer security and privacy. However, human actions when picking up passwords and inputting passwords are regarded as “the weakest link” in the authentication chain. Users tend to choose dictionary or short passwords rather than alphanumeric strings to make sure they can remember multiple accounts. And since cloud computing is a trend and web applications on desktops, browsers or apps have been spring up like mushrooms for the last few decades, people can access to their service any time and anywhere with mobile devices. This means that the probability of an authentication process being exposed in an environment vulnerable to a shoulder surfing attack increases. An attacker can observe directly or use external recording devices such as a high resolution camera and surveillance equipments to collect users’ credentials. To overcome these problems, we proposed PassMatrix, a novel authentication system based on graphical passwords that resist against shoulder surfing attack. With a one-time valid login indicator and circulative horizontal and vertical bars covering the entire scope of the pass-images, PassMatrix offers no hint for attackers to figure out or narrow down the real passwords of users even if they conduct multiple camera-based attacks. We also implemented a prototype of PassMatrix on Android and carried out real user experiments to check memorability and usability. From the evaluation result, it has proven that the proposed system achieves better results in resisting a shoulder surfing attack while maintaining usability.