# Is PassFace Authentication System secure?

In the passface authentication system, whether the passfaces are selected by the users or assigned by the system?

Is such system secure? How is user's passface stored on the server side?

Well it all depends on the number of faces you can choose from. Let's compare it with another, often-used two-factor mechanism: one-time passwords.

A one-time password often contains 6 numbers. Thus, there are 10^6th possibilities: 1000000. The chance of a hacker guessing your OTP is 1/1000000. Generally, this is considered to be a pretty high chance, compared to a good password (lower case, upper case, symbols, numbers). Passwords can be one out of, let's say, 98^10 (for there are 98 possible characters, and in case the password has a length of 10). 98^10 equals to 81707280688754689024. 1/81707280688754689024 is a much lower chance than 1/1000000. However, OTPs are secure because they are only valid one time and a limited amount of time, you can block brute-forcers etc. etc., that's not the point of your question.

So okay, considering we should compare apples to apples, we can compare the passface system with the OTP system. I did a demo on the passface website, and to login, I had to select 1 out of 9 faces, and repeat that three times. So the amount of possibilities is 9^3 = 729. A hacker has thus 1/729 chance to find my combination right from the first time, which is an enormously higher chance than 1/1000000 and even an infinite higher chance than 1/81707280688754689024.

Edit: Some sources note that the passface database contains more than 9 faces, and that they may dynamically change upon each try. Depending on how many faces there are in the database, the above calculation is thus not entirely correct. However, I want to point out that, in case the faces do change upon each try, that renders the system even less secure. The hacker could just retry a few times and see which faces change, and which faces remain the same (the ones that you chose have to remain in the faces set of course). Analysing this a bit more, the attacker could then easily reduce the search space. End of edit.

That chance is thus HUGE compared to other known systems (such as passwords, OTPs, keyfiles, etc.). So no, if the demo is a real-life implementation of the passface system, I would not deem it secure. Of course, some other measures matter:

• Is there a lock-out after a certain amount of tries?
• Is it 'just' used as a second factor?
• How often does the combination change? (i.e. how often do you need to learn new faces)

As an endnote: I saw that the passface system is marketeered as a 'replacement' for passwords, and that the 'overriding' password can only be used after a few days. If that is the case, I would say it is completely insecure, as the passface system is then the only factor.

By the way, I didn't go into details as to how Passface stores the faces. Probably just in a db, but anyway, my point is that even if the system itself is completely secure, the maths behind it just aren't.

• if the faces are stored in the db without any protection, this further reduces the security of Passface. – Curious Dec 31 '14 at 7:32

The answer to the first question. passfaces are assigned by the system. This is because user tend to select more attractive faces or faces of the people of their own region which can be exploited by the online guesser.