Security implications of password discretization for click-based graphical passwords

Zhu, Bin B. and Wei, Dongchen and Yang, Maowei and Yan, Jeff (2013) Security implications of password discretization for click-based graphical passwords. In: WWW 2013 - Proceedings of the 22nd International Conference on World Wide Web :. ACM, BRA, pp. 1581-1591. ISBN 9781450320351

Abstract

Discretization is a standard technique used in click-based graphical passwords for tolerating input variance so that approximately correct passwords are accepted by the system. In this paper, we show for the first time that two representative discretization schemes leak a significant amount of password information, undermining the security of such graphical passwords. We exploit such information leakage for successful dictionary attacks on Persuasive Cued Click Points (PCCP), which is to date the most secure click-based graphical password scheme and was considered to be resistant to such attacks. In our experiments, our purely automated attack successfully guessed 69.2% of the passwords when Centered Discretization was used to implement PCCP, and 39.4% of the passwords when Robust Discretization was used. Each attack dictionary we used was of approximately 235 entries, whereas the full password space was of 243 entries. For Centered Discretization, our attack still successfully guessed 50% of the passwords when the dictionary size was reduced to approximately 230 entries. Our attack is also applicable to common implementations of other click-based graphical password systems such as PassPoints and Cued Click Points - both have been extensively studied in the research communities. Copyright is held by the International World Wide Web Conference Committee (IW3C2).