A Graphical Two-Step Authentication System [duplicate]

Question

Changes made to system proposed in Two-factor authentication Without Mobile Phone:

1. In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image does not reveal any useful information. The user’s start image and path cannot be backtracked from the end image, since the user clicks only end image. The current system is not vulnerable to shoulder surfing.
2. Increased grid size from 28 to 40. 40 images can be displayed in proper size on screen, without making screen too cramped and keeps easy for user to find his start image.
3. Removed User Enumeration Vulnerability by adding password in Step 1.
4. In the previous system, user had 3 chances to write correct password related to his image. That has now been reduced to just 1 mouse click, decreasing chances given to a hacker for a single session.

I have developed a graphical authentication system, consisting of two-step authentication. The first step is normal user id – password authentication and the second step is the graphical authentication. I have tried to maintain the tradeoff between security and user experience. I have applied a patent for this system. Two-factor authentication surely does provide extra security, but also has some issues. So, I tried to develop an authentication system which would provide some extra security without considerable loss in user experience.

In short, for the second step, the user has to remember a Start image and a Path. Every time the user will try to login, the Start image will be placed at a valid random position, so on applying the Path from the Start image, the user may get a different End image every time. The user only has to click the End image.

Detailed description is as follows:

While registering, the user has to choose a user id and a password, required for first step of the authentication.

Then he has to choose his Start image.

Then his Start image would be displayed in a grid, where he has to choose his Path to get the End image.

Now, after the account is created, when the user will try to login, he will first enter his user id and password.

After passing this first step, the second step page will be displayed.

The second step consists of a grid of 40 images; the number of images is not too small or too large. The user’s Start image will be placed at a valid random position in the grid, along with 39 other images which will be the same for the user for each login session, so that the hacker does not get to know the Start image by observing multiple sessions. The user has to find his Start image in the grid and apply the Path from it, to get the end image. The user only has to click the End image. Depending on the position of the Start image, the end image could be different every time. This second step page is valid only for 90 seconds and redirects to the main page if the user has not chosen the End image.

The user authenticates successfully if he chooses the correct end image for the session.

The system takes care that the Start image gets placed at a position, such that after applying the Path, the End image’s position is in the grid.

Now, if the user logs out and tries to login again, he'll have to pass step 1 and then in step 2, the page could be displayed as:

The grid would have shuffled.

Similarly, for next login attempt, step 2 page could be:

and so on...

I would like to have some comments on entropy of the system. The only way by which a hacker can bypass this, is by randomly guessing an image each time. Is there any other way? Is this system usable in real-time?

Answer 1

Security

You're asking users to remember:

• a password above 8 characters
• an image
• a path relative to that image

And all that for what added security? The second step is a knowledge-factor just like the password, is exposed and provided via exactly the same channel, which means that attacks such as phishing, malware on the device, or breaking into your server will work just as easily.

Now, the goal of adding authentication steps rather than factors (of different types and exchanged/verified through different channels) is not to increase security, it's to increase usability. The first step would be to allow for users to have a simpler password in exchange for the extra pain you make them go through.

User Experience

Right now, it takes me a good 5 extra seconds to log in to your site than it would without this image. Does it sound ok? This is a single system, I have created my auth factor just before and it's fresh in my mind! Still if I had to use it 20 times a day I would lose 6 minutes' worth of productive work. Trying a second time five minutes after, I failed to authenticate already!

You say you "balanced the trade-offs between security and user experience", how is fiddling with a grid of images and counting numbers of rows and columns meant to help me? Can you understand how the frustration increases from a failed authentication just after so much reflective use of your UI? I didn't just make a typo by typing my password too fast, I was too damn stupid to click the right image even though I hesitated and counted!

User Experience is not: "I put some fancy colors and gave instructions so the user should be ok", it's more "The user made an effort, they deserve to get through, but yet failure rates and login times are higher than the previous system that just had passwords".

What you should expect at scale

Do you know what happens if users have to handle multiple graphical passwords? The performance decreases just like with passwords. Although multiple lab studies suggest the decrease is less radical than with PINs or text passwords, it is still here and we yet have to see proper field work showing how users cope with many graphical passwords, since they're limited in the expressiveness of their passwords and in their reuse strategies.

It's also worthy to note that whatever passwords a user will pick in a lab condition to test your software have a fair chance of being entirely different from what they would normally pick: that affects any study on the memorability of passwords.

In short, it's very good to come up with new solutions to the good old problem of passwords, but you should really note that there is hardly any evidence at all of something that actually works better at scale, and you should try to understand not the weaknesses but the strengths of passwords if you want to design something better for the majority of user authentications.

You cannot propose something that takes longer. You also cannot propose something that is harder to remember when I have more than ten instances of it to manage. Also, it's a very good idea to understand where your system is good and where it is bad, and to investigate which practices it is suited for. For instance passwords are bad for infrequent (couple times a year) authentication because you forget which password you used. PINs are better than passwords and gestures better than PINs for touch UI authentication in terms of the time to input them. And finally, the problem of passwords is not just a problem of factors, it's got to do primarily with the accumulation of them and with the processes that are available to handle them as a whole. There's a reason why password managers are so popular!

Edit 1: if you're serious about user experience and usability, leave the whole "usable security" thing aside for a while and get training in HCI and design. You really need a more conscious perspective on how you work, you need to teach yourself to think like a designer/ergonomics expert/usability expert rather than just "balance trade-offs" or "think about the user".

Edit 2: how often do cyber criminals shoulder surf you, and how often do they phish you or attack the server where your data is stored? Know your threats! Shoulder surfing is only relevant to a few types of services e.g. Facebook, mobile auth UIs... not the general case on the Web.

Answer 2

If the images are placed at random, except for one image, then the image, and the offset can be determined. (if you see that image selection screen enough times, the image will never next to the corner where the "end path" prevents it from doing so)

This is also very confusing for an end user, preventing the people who you want in the system from gaining access.

A more secure and simpler solution is to just pick the image directly.