This question already has an answer here:
Changes made to system proposed in Two-factor authentication Without Mobile Phone:
- In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image does not reveal any useful information. The user’s start image and path cannot be backtracked from the end image, since the user clicks only end image. The current system is not vulnerable to shoulder surfing.
- Increased grid size from 28 to 40. 40 images can be displayed in proper size on screen, without making screen too cramped and keeps easy for user to find his start image.
- Removed User Enumeration Vulnerability by adding password in Step 1.
- In the previous system, user had 3 chances to write correct password related to his image. That has now been reduced to just 1 mouse click, decreasing chances given to a hacker for a single session.
I have developed a graphical authentication system, consisting of two-step authentication. The first step is normal user id – password authentication and the second step is the graphical authentication. I have tried to maintain the tradeoff between security and user experience. I have applied a patent for this system. Two-factor authentication surely does provide extra security, but also has some issues. So, I tried to develop an authentication system which would provide some extra security without considerable loss in user experience.
In short, for the second step, the user has to remember a Start image and a Path. Every time the user will try to login, the Start image will be placed at a valid random position, so on applying the Path from the Start image, the user may get a different End image every time. The user only has to click the End image.
Detailed description is as follows:
While registering, the user has to choose a user id and a password, required for first step of the authentication.
Then he has to choose his Start image.
Then his Start image would be displayed in a grid, where he has to choose his Path to get the End image.
Now, after the account is created, when the user will try to login, he will first enter his user id and password.
After passing this first step, the second step page will be displayed.
The second step consists of a grid of 40 images; the number of images is not too small or too large. The user’s Start image will be placed at a valid random position in the grid, along with 39 other images which will be the same for the user for each login session, so that the hacker does not get to know the Start image by observing multiple sessions. The user has to find his Start image in the grid and apply the Path from it, to get the end image. The user only has to click the End image. Depending on the position of the Start image, the end image could be different every time. This second step page is valid only for 90 seconds and redirects to the main page if the user has not chosen the End image.
The user authenticates successfully if he chooses the correct end image for the session.
The system takes care that the Start image gets placed at a position, such that after applying the Path, the End image’s position is in the grid.
Now, if the user logs out and tries to login again, he'll have to pass step 1 and then in step 2, the page could be displayed as:
The grid would have shuffled.
Similarly, for next login attempt, step 2 page could be:
and so on...
I would like to have some comments on entropy of the system. The only way by which a hacker can bypass this, is by randomly guessing an image each time. Is there any other way? Is this system usable in real-time?