User-Generated Free-Form Gestures for Authentication: Security and Memorability (1401.0561v1)

Abstract: This paper studies the security and memorability of free-form multitouch gestures for mobile authentication. Towards this end, we collected a dataset with a generate-test-retest paradigm where participants (N=63) generated free-form gestures, repeated them, and were later retested for memory. Half of the participants decided to generate one-finger gestures, and the other half generated multi-finger gestures. Although there has been recent work on template-based gestures, there are yet no metrics to analyze security of either template or free-form gestures. For example, entropy-based metrics used for text-based passwords are not suitable for capturing the security and memorability of free-form gestures. Hence, we modify a recently proposed metric for analyzing information capacity of continuous full-body movements for this purpose. Our metric computed estimated mutual information in repeated sets of gestures. Surprisingly, one-finger gestures had higher average mutual information. Gestures with many hard angles and turns had the highest mutual information. The best-remembered gestures included signatures and simple angular shapes. We also implemented a multitouch recognizer to evaluate the practicality of free-form gestures in a real authentication system and how they perform against shoulder surfing attacks. We conclude the paper with strategies for generating secure and memorable free-form gestures, which present a robust method for mobile authentication.

• The paper analyzes the security and memorability of user-generated free-form gestures for mobile authentication using a mutual information metric and data from 63 participants.
• Key findings include that one-finger gestures are often more secure than multi-finger ones, and complex, sharp-turn gestures exhibit higher security while memorability decreases over time without practice.
• The research demonstrates the practical feasibility of integrating free-form gestures resistant to observational attacks and suggests future design work is needed to optimize gesture creation for security and recall.

Security and Memorability of Free-Form Gestures for Mobile Authentication

The paper "User-Generated Free-Form Gestures for Authentication: Security and Memorability" explores the viability of free-form multitouch gestures as an authentication method on mobile devices. This paper challenges the limitations of template-based gestures by analyzing the security and memorability of user-generated gestures which bypass common attack vectors like shoulder surfing and smudge attacks.

Methodology and Metrics

The authors collected data from 63 participants using a generate-test-retest paradigm. Participants created a gesture, repeated it multiple times, and attempted to recall it both immediately and after a delay of at least 10 days. The research uniquely adapted a metric based on mutual information to measure the security and memorability of these gestures. This mutual information approach evaluates gesture complexity by analyzing the variability and reproducibility of gesture trajectories, presenting a robust alternative to entropy measures typically used for text-based passwords.

Insights and Results

The paper revealed surprising results; one-finger gestures demonstrated higher average mutual information than multi-finger gestures. Complex gestures characterized by numerous sharp turns and signature-like shapes exhibited the highest mutual information, indicating greater security. Meanwhile, gestures with fewer turns or repetitive motions were less effective.

Importantly, the authors implemented a practical multitouch recognizer, which demonstrated the feasibility of integrating free-form gestures into authentication systems. This recognizer showed strong resistance against shoulder surfing, further supporting the security of free-form gestures.

The researchers also noticed substantial memorability in user-generated gestures, with a notable drop in mutual information after 10 days suggesting that frequent practice enhances recall. Although participants taped gestures with multiple fingers, often they did so in trivial ways that did not accrue additional information benefit, a crucial insight for future design considerations.

Implications

The paper's findings carry significant implications for mobile security methodologies. Free-form gestures, providing a larger password space than grid patterns, offer a promising path toward more secure mobile interactions. Moving beyond grid tracks to free-form gestures may allow authentication systems to leverage the nuanced subtleties of human movement, thus enhancing security while reducing susceptibility to observational attacks.

Future Research

Further investigation is needed to understand optimal gesture patterns and reconsider interface designs to encourage users to exploit gestures' security potential. Chronicling gesture stability and innovating guidance protocols to assist users in creating both secure and memorable gestures are pivotal next steps.

In conclusion, the authors present not just an analytical framework for gesture security evaluation but also practical implementations that fortify mobile authentication against prevalent threats. Their work lays groundwork for evolving our understanding of secure interactions with touchscreens, inviting future exploration into the potential to redefine mobile authentication paradigms.