Picture-based password scheme to resist shoulder-surfing attack

Wong, Ling Cent (2026) Picture-based password scheme to resist shoulder-surfing attack. Final Year Project, UTAR.

PDF Download (5Mb)

Abstract

Memorability can be a problem with traditional text-based passwords, and they are quite susceptible to observation-based attacks, including shoulder-surfing. This project introduces GridLock, a new recognition-based graphical password system, which overcomes these limitations by having a directional mechanism resembling a compass that integrates visual object selection with spatial memory. The system was produced as a fully operational Android application based on Firebase with four prototypes that were systematically compared (Compass Pro VIII, Compass Pro IV, Compass Lock IV, and Compass Lock VIII). These differences are in compass orientation (dynamic and static) and directional complexity (4-way and 8-way). The prototypes were tested on three fundamental dimensions: efficiency in registration and logging in, resistance to shoulder surfing, and long-term memorability, using a 7-day longitudinal test. Empirical evidence suggests that the initial usability of a prototype, with the fastest baseline login time (21.38s), was the static 4-directional prototype (Compass Lock IV), although the dynamic prototypes (Compass Pro) initially came with a greater cognitive load. This friction was solved soon, though, as users were able to perform at the level of an expert within days. Importantly, serious penetration tests showed that even with full logic disclosure, all prototypes obtained an absolute 0% breach rate, which indicates serious resistance to shoulder-surfing. By incorporating spatial-directional logic into graphical authentication, the paper concludes that it is indeed feasible to develop a workable password system that is able to solve the conventional trade-off between security, memorability, and usability.

Actions (login required)