Facelock: familiarity-based graphical authentication
Authentication codes such as passwords and PIN numbers are widely used to control access to resources. One major drawback of these codes is that they are difficult to remember. Account holders are often faced with a choice between forgetting a code, which can be inconvenient, or writing it down, whi...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
PeerJ Inc.
2014-06-01
|
| Series: | PeerJ |
| Subjects: | |
| Online Access: | https://peerj.com/articles/444.pdf |
| _version_ | 1797420547376676864 |
|---|---|
| author | Rob Jenkins Jane L. McLachlan Karen Renaud |
| author_facet | Rob Jenkins Jane L. McLachlan Karen Renaud |
| author_sort | Rob Jenkins |
| collection | DOAJ |
| description | Authentication codes such as passwords and PIN numbers are widely used to control access to resources. One major drawback of these codes is that they are difficult to remember. Account holders are often faced with a choice between forgetting a code, which can be inconvenient, or writing it down, which compromises security. In two studies, we test a new knowledge-based authentication method that does not impose memory load on the user. Psychological research on face recognition has revealed an important distinction between familiar and unfamiliar face perception: When a face is familiar to the observer, it can be identified across a wide range of images. However, when the face is unfamiliar, generalisation across images is poor. This contrast can be used as the basis for a personalised ‘facelock’, in which authentication succeeds or fails based on image-invariant recognition of faces that are familiar to the account holder. In Study 1, account holders authenticated easily by detecting familiar targets among other faces (97.5% success rate), even after a one-year delay (86.1% success rate). Zero-acquaintance attackers were reduced to guessing (<1% success rate). Even personal attackers who knew the account holder well were rarely able to authenticate (6.6% success rate). In Study 2, we found that shoulder-surfing attacks by strangers could be defeated by presenting different photos of the same target faces in observed and attacked grids (1.9% success rate). Our findings suggest that the contrast between familiar and unfamiliar face recognition may be useful for developers of graphical authentication systems. |
| first_indexed | 2024-03-09T07:03:02Z |
| format | Article |
| id | doaj.art-3cfd13e703a44e75b50656d816327d58 |
| institution | Directory Open Access Journal |
| issn | 2167-8359 |
| language | English |
| last_indexed | 2024-03-09T07:03:02Z |
| publishDate | 2014-06-01 |
| publisher | PeerJ Inc. |
| record_format | Article |
| series | PeerJ |
| spelling | doaj.art-3cfd13e703a44e75b50656d816327d582023-12-03T09:46:17ZengPeerJ Inc.PeerJ2167-83592014-06-012e44410.7717/peerj.444444Facelock: familiarity-based graphical authenticationRob Jenkins0Jane L. McLachlan1Karen Renaud2Department of Psychology, University of York, United KingdomSchool of Psychology, University of Glasgow, United KingdomSchool of Computing Science, University of Glasgow, United KingdomAuthentication codes such as passwords and PIN numbers are widely used to control access to resources. One major drawback of these codes is that they are difficult to remember. Account holders are often faced with a choice between forgetting a code, which can be inconvenient, or writing it down, which compromises security. In two studies, we test a new knowledge-based authentication method that does not impose memory load on the user. Psychological research on face recognition has revealed an important distinction between familiar and unfamiliar face perception: When a face is familiar to the observer, it can be identified across a wide range of images. However, when the face is unfamiliar, generalisation across images is poor. This contrast can be used as the basis for a personalised ‘facelock’, in which authentication succeeds or fails based on image-invariant recognition of faces that are familiar to the account holder. In Study 1, account holders authenticated easily by detecting familiar targets among other faces (97.5% success rate), even after a one-year delay (86.1% success rate). Zero-acquaintance attackers were reduced to guessing (<1% success rate). Even personal attackers who knew the account holder well were rarely able to authenticate (6.6% success rate). In Study 2, we found that shoulder-surfing attacks by strangers could be defeated by presenting different photos of the same target faces in observed and attacked grids (1.9% success rate). Our findings suggest that the contrast between familiar and unfamiliar face recognition may be useful for developers of graphical authentication systems.https://peerj.com/articles/444.pdfFace recognitionIdentificationAuthenticationHuman factors |
| spellingShingle | Rob Jenkins Jane L. McLachlan Karen Renaud Facelock: familiarity-based graphical authentication PeerJ Face recognition Identification Authentication Human factors |
| title | Facelock: familiarity-based graphical authentication |
| title_full | Facelock: familiarity-based graphical authentication |
| title_fullStr | Facelock: familiarity-based graphical authentication |
| title_full_unstemmed | Facelock: familiarity-based graphical authentication |
| title_short | Facelock: familiarity-based graphical authentication |
| title_sort | facelock familiarity based graphical authentication |
| topic | Face recognition Identification Authentication Human factors |
| url | https://peerj.com/articles/444.pdf |
| work_keys_str_mv | AT robjenkins facelockfamiliaritybasedgraphicalauthentication AT janelmclachlan facelockfamiliaritybasedgraphicalauthentication AT karenrenaud facelockfamiliaritybasedgraphicalauthentication |