Persuasive Cued Click Points Design Implementation and Evaluation

Abstract

This project presents an integrated evaluation of the Persuasive Cued Click-Points graphical password scheme. It includes usability and security evaluations, and implementation considerations. Knowledge-based authentication systems are to support users in selecting passwords of higher security, in the sense of being from an expanded effective security space. I use persuasion to influence user choice in click-based graphical passwords, encouraging users to select more random, and hence more difficult to guess, click-points. The problems of knowledge-based authentication (text password) are well known. Users often create memorable passwords that are easy for attackers to guess. Strong system-assigned passwords are difficult for users to remember. A password authentication system should encourage strong passwords while maintaining memorability. In proposed system authentication schemes allow user choice while influencing users towards stronger passwords. In our system, the task of selecting weak passwords (which are easy for attackers to predict) is more tedious, discouraging users from making such choices. In effect, this approach makes choosing a more secure password the path-of-least-resistance. It is easier to follow the system’s suggestions for a secure password — a feature lacking in most schemes. Paper provides new evaluation of password distributions, extends security analysis including relevant recent attacks.

Existing System

 Text passwords are the most popular user authentication method, but have security and usability problems.  Biometric systems and tokens have their own drawbacks.

Proposed System

 Authentication schemes allow user choice while influencing users towards stronger passwords.  In our system, the task of selecting weak passwords (which are easy for attackers to predict) is more tedious, discouraging users from making such choices.  In effect, this approach makes choosing a more secure password the path-of-least-resistance.  It is easier to follow the system’s suggestions for a secure password — a feature lacking in most schemes.  Paper provides new evaluation of password distributions, extends security analysis including relevant recent attacks.

Architecture