Memorability of Cued-Recall Graphical Passwords

with Saliency Masks

Florian Alt

1

, Mateusz Mikusz

2

, Stefan Schneegass

3

, Andreas Bulling

Cued-recall graphical passwords have a lot of potential for

secure user authentication, particularly if combined with

saliency masks to prevent users from selecting weak pass-

words. Saliency masks were shown to significantly improve

password security by excluding those areas of the image that

are most likely to lead to hotspots. In this paper we investi-

gate the impact of such saliency masks on the memorability

of cued-recall graphical passwords. We first conduct two pre-

studies (N=52) to obtain a set of images with three different

image complexities as well as real passwords. A month-long

password points. These results complement prior work on

the security of such passwords and underline the potential of

saliency masks as both a secure and usable improvement to

cued-recall gaze-based graphical passwords.

Author Keywords

User authentication; Cued-recall graphical passwords;

Memorability; User study; Saliency masks

ACM Classification Keywords

H.5.2 Information Interfaces and Presentation: User Inter-

faces—Input devices and strategies; K.6.5 Computing Milieux:

Permission to make digital or hard copies of all or part of this work for personal or

classroom use is granted without fee provided that copies are not made or distributed

for profit or commercial advantage and that copies bear this notice and the full citation

on the first page. Copyrights for components of this work owned by others than the

author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or

republish, to post on servers or to redistribute to lists, requires prior specific permission

and/or a fee. Request permissions from [email protected].

MUM ’16, Deceomber 12 – 15, 2016, Rovaniemi, Finland

Copyright is held by the owner/author(s). Publication rights licensed to ACM.

ACM 978-1-4503-4860-7/16/12...$15.00

password), or a cued-recall task (the user is presented cues, for

example, an image, that help them to recall their password).

Cued-recall graphical passwords in particular have consider-

meric passwords or PINs, as they leverage the vast capacity

is their increased resistance to guessing attacks, due to the

potentially larger theoretical password space [10]. In addition,

culated using a computational model of visual attention and

can effectively prevent users from choosing weak password

points that fall into attentional hotspots.

open question what impact they have on the ability of users to

remember their passwords over long periods of time. In this

work we investigate the impact of saliency masks on short-

term and long-term password memorability in a study with 26

participants. Furthermore, our investigation provides insights

graphical passwords on images with different complexities

with and without saliency masks as well as 4-digit PINs.

RELATED WORK

and techniques to improve password memorability.

Memorability of Graphical Passwords

Password memorability has long been identified as one of

the most critical usability issues [9] with 4-5 regularly used

passwords per user considered to be a maximum [1]. Graphi-

cal passwords were shown to have considerable memorability

made fewer login errors compared to users of alphanumeric

passwords, despite accessing the system less frequently [8].

Similar findings were obtained by Davis et al. who performed

a brief memorability comparison between PassFaces and pass-

words consisting of sequences of face images [13].

Dhamija and Perrig proposed a system were users authenti-

cated by recognizing previously seen images [15]. They com-

pared their system with user-generated alphanumeric pass-

words and 4-digit PINs and found that, after one week, par-

ticipants only made 5 % errors with their system compared to

more than 30 % with passwords and PINs.

Widenbeck et al. presented a click-based graphical password

memorize password points accurately enough.

the image on which password points are selected. In this way,

the resistance against so called smudge-attacks is enhanced.

In the context of a usability study participants rated the memo-

rability of the approach to be very high (5 on a 5-Point Likert

scale). Data were collected using experience sampling from

users who had downloaded and installed the app from Google-

Play. Hence, no information is available as to how long they

users to select one point per image but for a sequence of several

images. In an initial study they found that performance was

and that users preferred their approach over PassPoints [12]. In

an additional laboratory and large-scale field study they were

able to validate their earlier usability claims with respect to

password memorability but they also found that the choice of

multiple-password recall [33]. They compared two methods

to alleviate interferences and found that providing the user

with the first letter of their alphanumeric password led to

significant improvement of memorability. In a similar study,

Vu et al. evaluated the accuracy for recalling alphanumeric

passwords, derived from the first letters of the words of a

sentence, and found these to be more memorable than ran-

niques to improve the memorability of alphanumeric and cued-

uated long-term password memorability over the duration of

The goal and novel contribution of this work is to evaluate

memorability for saliency masks in the long-term that were so

far only shown to increase the security of cued-recall graphical

performance to the original visual saliency algorithm presented

by Itti et al. [19]. The saliency masks were calculated using

way but we made sure to obtain images with a resolution of at

least 1600

scaled down to that resolution if need be. To obtain complexity

ratings for these images, we created a website that displayed

two random but always different images next to each other.

Participants were then asked to click on the image they con-

sidered to be more complex (see Figure 2a). It is important

to note that we didn’t provide any definition of complexity

subjective notion of “image complexity”.

ing the study to be able to evaluate a-posteriori how consistent

each participant had been in rating the complexity. Participants

were recruited from University’s mailing lists, and were not

43 participants (23 female and 20 male) aged between 20

and 68 years (

the overall complexity of each image we calculated how often

participants considered an image to be more complex than

another. The most complex image was selected 276 times,

consistently, 15 participants rated two out of three consistently,

two participants rated one out of three consistently, and no

participant rated all image pairs inconsistently. We selected

three images for the main study: the most complex image (high

complexity), the image ranked tenth (medium complexity),

and the least complex image (low complexity). A statistical

analysis of the ratings for these images confirmed that the

image rated as most complex was significantly more complex

passwords for each of the three images as well as with and

without saliency mask (Figure 2b). The saliency masks were

overlaid in red onto the original images and it was not possible

for participants to click into these areas. It was also impossible

limit for creating the passwords and participants were allowed

to modify the password as often as needed. To ensure that

participants selected passwords they could remember, they had

to validate the password directly prior to finally submitting it.

If they were not able to validate the passwords within three

10 PINs that we initially collected (“0000” and “1234”).

Main Study

The pre-studies yielded a set of images with different complex-

ities as well as real passwords chosen by users. The goal of

the main study was to investigate the impact of saliency masks

on short- and long-term password memorability. To this end,

Figure 3: Example login attempt. Blue dots and lines denote the pass-

word to be remembered, while green dots indicate correctly and red dots

wrongly entered password points. White circles visualize the accepted in-

put area around each password point (not shown to participants).

image without a saliency mask (GP).

We created a web interface where participants could login

using their PIN and graphical passwords. PIN entry was im-

plemented using a standard HTML text form. To enter their

graphical passwords, participants could select password points

by clicking on the image with the mouse.

for the first time, the initial session was started. Participants

to complete a short demographic questionnaire. Afterwards,

participants were given a brief tutorial in which they were

explained the interface and how to enter passwords using the

mouse. Participants were then shown the first password and

asked to immediately validate it by using it to log into the

password again. This procedure was repeated for all three pass-

words. Following the validation, participants were asked for

their opinion on whether they would be able to remember their

passwords (5-point Likert item, 1: won’t be able to remember

Figure 4: Percentages of successful logins (three attempts to correctly

enter the password) for the different types of passwords in the validation

session as well as after one, two and four weeks.

ceived an email reminding them to log in using the graphical

24 hours. If they did not login within a maximum of 48 hours

they were excluded from the study. The presentation order of

the passwords was randomized for each session. Participants

had three login attempts for each of the three passwords. Simi-

Finally, all participants who finished the fourth week of the

study were asked to complete a short online questionnaire

on the perceived complexity of all three images used in the

complex/difficult to remember; 5: very complex/difficult to

remember). Given that writing down passwords is common

practice [1], we also asked for any password aids participants

had used, as well as the daily context in which they had partic-

ipated (for example, at home, at work, while traveling).

with an earlier study on the security of cued-recall graphical

passwords using saliency masks [10].

The downside of this approach is that, in a real-world system,

the success of a login attempt, and in turn password memorabil-

the threshold is too small, users won’t be able to login success-

but security would decrease considerably as well given that

any reasonably close password point would be accepted by the

authentication system. We therefore also evaluated memorabil-

Figure 5: Number of failed login attempts for PINs and graphical pass-

word with / without saliency mask over all four sessions (four weeks),

averaged over all participants. Error bars indicate the standard error.

four selected and actual password points. This approach does

and completed the validation session. Overall, 42 participants

dropped out over the course of the following four weeks. In the

end, 26 participants (six female, 20 male) aged between 21 and

48 years (

,

until after the fourth week. Table 1 provides an overview of

all results discussed in the following sections.

Overall Password Memorability

First, we evaluated overall password memorability for the three

types of passwords considered in this work: 4-digit PIN, graph-

ical password with saliency mask, and graphical password

number of failed login attempts across all password types in-

creased considerably after one week (

,

),

it decreased again after two (

,

), indicat-

ing a learning effect, and remained stable after four weeks

(

,

). We tested whether the type of pass-

word had any effect on memorability using a one-way repeated

measures analysis of variance (ANOVA). The ANOVA showed

no statistically significant difference between the three types

of passwords,

,

sphericity could not show a statistically significant differences

To analyse password memorability in more detail, we followed

the multi-store memory model by Atkinson and Shiffrin [4].

According to their model, short-term memory lasts for approxi-

mately 15 to 30 seconds, while long-term memory provides the

lasting retention of information and lasts from several minutes

Table 1: Overview of the main study results. Statistically significant results are marked with a *. Note that the measure for the baseline tests is the

number of failed login attempts, whereas for analyzing saliency masks and image complexity the new measure based on Euclidean distance between

password points was used.

Figure 6: Euclidean distances between the selected and actual password

points for graphical passwords with and without saliency mask over all

four sessions (four weeks), averaged over all participants. Error bars

indicate the standard error.

validation about 30 seconds after receiving their passwords.

Thus, in the following analysis, we distinguish between short-

measures ANOVA on the number of failed login attempts of all

26 participants after one, two, and four weeks (Table 2). The

memorability between password types,

significant difference,

,

. The effect size

was small, η

2

Impact of Saliency Masks on Graphical Passwords

Table 2: Means and standard deviations of the number of failed login attempts for different password types after first, second, and fourth week of study.

3

),

,

,

. To analyze the perceived image

complexity we used a Friedman analysis of variance by ranks

We also asked for the context in which participants had con-

ducted the study. This included the location or situation in

which they entered the passwords, any memory aids used, or

whether any elements in the images helped them to memorize

the passwords. For the memory aids, we explicitly told partici-

pants that their answer would not influence their chances in the

Figure 8: Distribution of responses to question “How difficult was it to

We found that 17 out of 24 participants performed the study

at home, four did so at work, and three in varying locations

participants wrote down the passwords, while seven partici-

pants used other types of memory aids or mnemonics.

different strategies for defining passwords, such as selecting

the password.”, P17). Finally, some participants reported that

the symmetric alignment of password points made it easier to

remember the complete password.

Similarly, participants in the main study reported of having

used different strategies to memorize PINs. Some created

equations from the digits (for example, the first digit is the

(“The last two digits were my birthday in reverse order.”,

P38), created sequences of ascending or descending digits,

memorized the arrangement of the digits on a keypad, or fitted

found that at the end of our study, users on average selected

points about 30 px further away from the actual password point,

compared to passwords defined on images without saliency

masks. This suggests a tradeoff between security and usability

cation schemes based on graphical passwords. Interestingly,

this distance constantly became smaller during our study, sug-

to that ultimately password points are remembered more accu-

rately. This needs to be investigated in future work.

images provide more opportunities to select memorable pass-

word points. This suggests that images of high complexity

Furthermore, we qualitatively assessed heat maps created from

passwords which participants of the main study rated to be

easy and difficult to remember. Heat maps visually encode

image areas in which password points were selected by several

participants; the more password points fall in a specific box

a masked out object, which aided memorability. Also, users

still defined passwords close to prominent points that were,

however, masked out. This seemed to make it much more

difficult for users to remember these passwords, probably

also due to the fact that the saliency mask was missing as a

reference in the authentication interface. From this we learn

defining password points that consider the saliency mask as

a reference point. An immediate validation upon registration

may make this challenge apparent to users.

guessing the password points. Note, however, that there could

example, if the image showed a number of people, some of

which are close friends of the user. As a result, an attacker

might guess that password points were defined on the faces of

increase memorability while not hinting at password points,

users could be asked a number of questions upon registration

to a graphical password system, for example, about pets they

the tested image set was limited. We cannot exclude further

While authentication systems such as ATMs use pre-defined

passwords as an additional security enhancing property, many

current systems use user-defined passwords. The presented

portant to note that graphical passwords with saliency masks

ited to touch and gaze – or even a combination [21]. This

main that requires user authentication, from simple online

passwords schemes can be implemented on these platforms.

For example, it is not clear whether users should be allowed to

choose images and/or passwords themselves or whether cer-

tain password patterns or shapes should be enforced or maybe

even prohibited to increase security and memorability.

exists to create secure and memorable graphical passwords.

Password points could be randomly distributed over the image

but this ignores the potential of constructing password aids

based on the selected points, for example, as seen in this

is interesting to think of how a random graphical password

generator would look like and how it could consider such aids

to make the generated passwords more memorable.

CONCLUSION

In this work we conducted an analysis of the impact of saliency

ACKNOWLEDGEMENTS

Note, that for copyright reasons we were not able to include

similar to those used in our studies.

REFERENCES

1.

2. Florian Alt, Stefan Schneegass, Alireza Sahami Shirazi,

3. Antonella De Angeli, Lynne Coventry, Graham Johnson,

4.

7.

8.

9. Alan S. Brown, Elisabeth Bracken, Sandy Zoccoli, and