research-article

User-generated free-form gestures for authentication: security and memorability

Authors:

Michael Sherman,

Gradeigh Clark,

Shridatt Sugrim,

Janne Lindqvist,

Antti Oulasvirta,

Teemu RoosAuthors Info & Claims

MobiSys '14: Proceedings of the 12th annual international conference on Mobile systems, applications, and services

Pages 176 - 189

https://doi.org/10.1145/2594368.2594375

Published: 02 June 2014 Publication History

Abstract

This paper studies the security and memorability of free-form multitouch gestures for mobile authentication. Towards this end, we collected a dataset with a generate-test-retest paradigm where participants (N=63) generated free-form gestures, repeated them, and were later retested for memory. Half of the participants decided to generate one-finger gestures, and the other half generated multi-finger gestures. Although there has been recent work on template-based gestures, there are yet no metrics to analyze security of either template or free-form gestures. For example, entropy-based metrics used for text-based passwords are not suitable for capturing the security and memorability of free-form gestures. Hence, we modify a recently proposed metric for analyzing information capacity of continuous full-body movements for this purpose. Our metric computed estimated mutual information in repeated sets of gestures. Surprisingly, one-finger gestures had higher average mutual information. Gestures with many hard angles and turns had the highest mutual information. The best-remembered gestures included signatures and simple angular shapes. We also implemented a multitouch recognizer to evaluate the practicality of free-form gestures in a real authentication system and how they perform against shoulder surfing attacks. We discuss strategies for generating secure and memorable free-form gestures. We conclude that free-form gestures present a robust method for mobile authentication.

References

[1]

A. J. Aviv, K. Gibson, E. Mossop, M. Blaze, and J. M. Smith. Smudge attacks on smartphone touch screens. In Proc. of WOOT'10.

Digital Library

[2]

R. Biddle, S. Chiasson, and P. Van Oorschot. Graphical passwords: Learning from the first twelve years. ACM Comput. Surv., Sept. 2012.

Digital Library

[3]

C. Bo, L. Zhang, X.-Y. Li, Q. Huang, and Y. Wang. Silentsense: Silent user identification via touch and movement behavioral biometrics. In Proc. of MobiCom '13.

Digital Library

[4]

J. Bonneau. The science of guessing: Analyzing an anonymized corpus of 70 million passwords. In Proc. of IEEE SS&P'12.

Digital Library

[5]

J. Bonneau, C. Herley, P. van Oorschot, and F. Stajano. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. In Proc. of IEEE SS&P'12, May 2012.

Digital Library

[6]

S. Boztas. Entropies, guessing and cryptography. Technical report, RMIT University Research Report Series, 1999.

[7]

W. E. Burr, D. F. Dodson, E. M. Newton, R. A. Perlner, W. T. Polk, S. Gupta, and E. A. Nabbus. NIST SP 800-63-1. Electronic Authentication Guideline, 2011.

Digital Library

[8]

Z. Cai, C. Shen, M. Wang, Y. Song, and J. Wang. Mobile authentication through touch-behavior features. In Proc. of Biometric Recognition, 2013.

[9]

S. Chiasson, A. Forget, E. Stobert, P. C. van Oorschot, and R. Biddle. Multiple password interference in text passwords and click-based graphical passwords. In Proc. of CCS'09.

Digital Library

[10]

T. M. Cover and J. A. Thomas. Elements of Information Theory. Wiley-Interscience, 2006.

Digital Library

[11]

A. De Luca, E. von Zezschwitz, N. D. H. Nguyen, M.-E. Maurer, E. Rubegni, M. P. Scipioni, and M. Langheinrich. Back-of-device authentication on smartphones. In Proc. of CHI '13.

Digital Library

[12]

K. M. Everitt, T. Bragin, J. Fogarty, and T. Kohno. A comprehensive study of frequency, interference, and training of multiple graphical passwords. In Proc. of CHI'09.

Digital Library

[13]

J. Fierrez, J. Ortega-Garcia, D. Ramos, and J. Gonzalez-Rodriguez.uppercaseHMM-based on-line signature verification: Feature extraction and signature modeling. Pattern Recogn. Lett., Dec. 2007.

Digital Library

[14]

D. Florencio and C. Herley. A large-scale study of web password habits. In Proc. of WWW'07.

Digital Library

[15]

M. Frank, R. Biedert, E. Ma, I. Martinovic, and D. Song. Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE Trans. on Information Forensics and Security, Jan 2013.

[16]

Gogogate. www.gogogate.com. Ref. Dec 3, 2013.

[17]

S. A. Grandhi, G. Joue, and I. Mittelberg. Understanding naturalness and intuitiveness in gesture production: insights for touchless gestural interfaces. In Proc. of CHI '11.

Digital Library

[18]

S. G. Hart and L. E. Staveland. Development of NASA-TLX (Task Load Index): Results of empirical and theoretical research. 1988. P. Hancock & N. Meshkati (Eds.), Human mental workload.

[19]

I. Jermyn, A. Mayer, F. Monrose, M. K. Reiter, and A. D. Rubin. The design and analysis of graphical passwords. In Proc. of USENIX Security'99.

Digital Library

[20]

L. A. Jones and S. J. Lederman. Human hand function. Oxford University Press, 2006.

[21]

Y. Li. Protractor: a fast and accurate gesture recognizer. In Proc. of CHI '10.

Digital Library

[22]

A. C. Long, J. A. Landay, and L. A. Rowe. "Those look similar!" issues in automating gesture design advice. In Proc. of PUI'01.

Digital Library

[23]

Microsoft. Windows azure multi-factor authentication. www.windowsazure.com/en-us/documentation/services/multi-factor-authentication. Ref. Dec 3, 2013.

[24]

D. Muramatsu and T. Matsumoto. AnuppercaseHMM on-line signature verifier incorporating signature trajectories. In Proc. of ICDAR '03.

Digital Library

[25]

U. Oh and L. Findlater. The challenges and potential of end-user gesture customization. In Proc. of CHI '13.

Digital Library

[26]

P. C. v. Oorschot and J. Thorpe. On predictive models and user-drawn graphical passwords. ACM Trans. Inf. Syst. Secur., jan 2008.

Digital Library

[27]

A. Oulasvirta, T. Roos, A. Modig, and L. Leppanen. Information capacity of full-body movements. In Proc. of CHI'13.

Digital Library

[28]

Q. Pu, S. Gupta, S. Gollakota, and S. Patel. Whole-home gesture recognition using wireless signals. In Proc. of MobiCom '13.

Digital Library

[29]

D. Rubine. Specifying gestures by example. In Proc. of SIGGRAPH '91.

Digital Library

[30]

J. Ruiz, Y. Li, and E. Lank. User-defined motion gestures for mobile interaction. In Proc. of CHI '11.

Digital Library

[31]

N. Sae-Bae, K. Ahmed, K. Isbister, and N. Memon. Biometric-rich gestures: a novel approach to authentication on multi-touch devices. In Proc. of CHI '12.

Digital Library

[32]

D. Savransky. Lomb (lomb-scargle) periodogram, 2008. http://www.mathworks.com/matlabcentral/fileexchange/20004-lomb-lomb-scargle-periodogram. Ref Dec 9, 2013.

[33]

F. Schaub, M. Walch, B. Könings, and M. Weber. Exploring the design space of graphical passwords on smartphones. In Proc. of SOUPS '13.

Digital Library

[34]

A. Serwadda and V. V. Phoha. When kids' toys breach mobile phone security. In Proc. of CCS '13.

Digital Library

[35]

M. Shahzad, A. X. Liu, and A. Samuel. Secure unlocking of mobile touch screen devices by simple gestures: You can see it but you can not do it. In Proc. of MobiCom '13.

Digital Library

[36]

Square. www.squareup.com. Ref. Dec 3, 2013.

[37]

J. Thorpe and P. C. van Oorschot. Human-seeded attacks and exploiting hot-spots in graphical passwords. In Proc. of USENIX Security'07.

Digital Library

[38]

J. Tian, C. Qu, W. Xu, and S. Wang. Kinwrite: Handwriting-based authentication using kinect. In Proc. of NDSS '13.

[39]

B. Ur, P. Kelley, S. Komanduri, J. Lee, M. Maass, M. Mazurek, T. Passaro, R. Shay, T. Vidas, L. Bauer, N. Christin, L. Cranor, S. Egelman, and J. Lopez. Helping users create better passwords. ;login, Dec. 2012.

[40]

S. Wiedenbeck, J. Waters, J.-C. Birget, A. Brodskiy, and N. Memon. Passpoints: design and longitudinal evaluation of a graphical password system. Int. J. Hum.-Comput. Stud., 63(1--2):102--127, July 2005.

Digital Library

[41]

J. O. Wobbrock, A. D. Wilson, and Y. Li. Gestures without libraries, toolkits or training: a $1 recognizer for user interface prototypes. In Proc. of UIST '07.

Digital Library

[42]

J. Yan, A. Blackwell, R. Anderson, and A. Grant. Password memorability and security: Empirical results. IEEE Security and Privacy, Sept. 2004.

Digital Library

[43]

N. H. Zakaria, D. Griffiths, S. Brostoff, and J. Yan. Shoulder surfing defence for recall-based graphical passwords. In Proc. of SOUPS'11.

Digital Library

[44]

Z. Zhao and G.-J. Ahn. On the security of picture gesture authentication. In Proc. of USENIX Security'13.

Digital Library

[45]

N. Zheng, K. Bai, H. Huang, and H. Wang. You are how you touch: User verication on smartphones via tapping behaviors. Technical report, Dec. 2006.

[46]

F. Zhou and F. De la Torre. Canonical time warping for alignment of human behavior. In Proc. of NIPS'09.

Cited By

Weichbroth P(2024)Usability of Mobile Applications: A Consolidated ModelIEEE Access10.1109/ACCESS.2024.339552812(62378-62391)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3395528
Cheon EHuh JOakley I(2023)GestureMeter: Design and Evaluation of a Gesture Password Strength MeterProceedings of the 2023 CHI Conference on Human Factors in Computing Systems10.1145/3544548.3581397(1-19)Online publication date: 19-Apr-2023
https://dl.acm.org/doi/10.1145/3544548.3581397
Zhang YHan DLi ALi JLi TZhang Y(2023)SmartMagnet: Proximity-Based Access Control for IoT Devices With Smartphones and MagnetsIEEE Transactions on Mobile Computing10.1109/TMC.2022.314974622:7(4266-4278)Online publication date: 1-Jul-2023
https://doi.org/10.1109/TMC.2022.3149746
Show More Cited By

Index Terms

User-generated free-form gestures for authentication: security and memorability
1. Human-centered computing

Recommendations

Free-Form Gesture Authentication in the Wild
CHI '16: Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems

Free-form gesture passwords have been introduced as an alternative mobile authentication method. Text passwords are not very suitable for mobile interaction, and methods such as PINs and grid patterns sacrifice security over usability. However, little ...
Video: User-generated free-form gestures for authentication: security and memorability
MobiSys '14: Proceedings of the 12th annual international conference on Mobile systems, applications, and services

This is a video demonstration for a full paper available in MobiSys'14 proceedings http://dx.doi.org/10.1145/2594368.2594375. The video demonstrates several forms of authentication on a common tablet, and compares them to our method for gesture-based ...
User-defined gestures for free-hand TV control
EuroITV '12: Proceedings of the 10th European Conference on Interactive TV and Video

As researchers and industry alike are proposing TV interfaces that use gestures in their designs, understanding users' preferences for gesture commands becomes an important problem. However, no rules or guidelines currently exist to assist designers and ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

MobiSys '14: Proceedings of the 12th annual international conference on Mobile systems, applications, and services

June 2014

410 pages

ISBN:9781450327930

DOI:10.1145/2594368

General Chairs:
Andrew Campbell
Dartmouth College, USA
,
David Kotz
Dartmouth College, USA
,
Program Chairs:
Landon Cox
Duke University, USA
,
Z. Morley Mao
University of Michigan, USA

Copyright © 2014 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGMOBILE: ACM Special Interest Group on Mobility of Systems, Users, Data and Computing

In-Cooperation

SIGOPS: ACM Special Interest Group on Operating Systems

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 02 June 2014

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

National Science Foundation

Conference

MobiSys'14

Sponsor:

SIGMOBILE

MobiSys'14: The 12th Annual International Conference on Mobile Systems, Applications, and Services

June 16 - 19, 2014

New Hampshire, Bretton Woods, USA

Acceptance Rates

MobiSys '14 Paper Acceptance Rate 25 of 185 submissions, 14%;

Overall Acceptance Rate 274 of 1,679 submissions, 16%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

76
Total Citations
View Citations
1,288
Total Downloads

Downloads (Last 12 months)35
Downloads (Last 6 weeks)5

Reflects downloads up to 22 Dec 2024

Other Metrics

View Author Metrics

Citations

Cited By

Weichbroth P(2024)Usability of Mobile Applications: A Consolidated ModelIEEE Access10.1109/ACCESS.2024.339552812(62378-62391)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3395528
Cheon EHuh JOakley I(2023)GestureMeter: Design and Evaluation of a Gesture Password Strength MeterProceedings of the 2023 CHI Conference on Human Factors in Computing Systems10.1145/3544548.3581397(1-19)Online publication date: 19-Apr-2023
https://dl.acm.org/doi/10.1145/3544548.3581397
Zhang YHan DLi ALi JLi TZhang Y(2023)SmartMagnet: Proximity-Based Access Control for IoT Devices With Smartphones and MagnetsIEEE Transactions on Mobile Computing10.1109/TMC.2022.314974622:7(4266-4278)Online publication date: 1-Jul-2023
https://doi.org/10.1109/TMC.2022.3149746
Liu YZhang SGowda M(2023)A Practical System for 3-D Hand Pose Tracking Using EMG Wearables With Applications to Prosthetics and User InterfacesIEEE Internet of Things Journal10.1109/JIOT.2022.322360010:4(3407-3427)Online publication date: 15-Feb-2023
https://doi.org/10.1109/JIOT.2022.3223600
Ibrahim NSellahewa H(2023)A cross-setting study of user unlocking behaviour in a graphical authentication scheme: a case study on android Pattern UnlockInternational Journal of Information Security10.1007/s10207-023-00722-x22:6(1849-1863)Online publication date: 7-Jul-2023
https://doi.org/10.1007/s10207-023-00722-x
Liu YZhang SGowda MNelakuditi S(2022)Leveraging the Properties of mmWave Signals for 3D Finger Motion Tracking for Interactive IoT ApplicationsProceedings of the ACM on Measurement and Analysis of Computing Systems10.1145/35706136:3(1-28)Online publication date: 8-Dec-2022
https://dl.acm.org/doi/10.1145/3570613
Zhou HLu TLiu YZhang SGowda M(2022)Learning on the RingsProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/35345876:2(1-31)Online publication date: 4-Jul-2022
https://doi.org/10.1145/3534587
Magrofuoco NRoselli PVanderdonckt J(2022)µV: An Articulation, Rotation, Scaling, and Translation Invariant (ARST) Multi-stroke Gesture RecognizerProceedings of the ACM on Human-Computer Interaction10.1145/35322006:EICS(1-25)Online publication date: 17-Jun-2022
https://dl.acm.org/doi/10.1145/3532200
Song YCai Z(2022)Integrating Handcrafted Features with Deep Representations for Smartphone AuthenticationProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/35173326:1(1-27)Online publication date: 29-Mar-2022
https://dl.acm.org/doi/10.1145/3517332
Marky KRagozin KChernyshov GMatviienko ASchmitz MMühlhäuser MEghtebas CKunze K(2022)“Nah, it’s just annoying!” A Deep Dive into User Perceptions of Two-Factor AuthenticationACM Transactions on Computer-Human Interaction10.1145/350351429:5(1-32)Online publication date: 20-Oct-2022
https://dl.acm.org/doi/10.1145/3503514
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

EPUB

View this article in ePub.

Media

Figures

Other

Tables

View Table of Contents