Password management using doodles

ABSTRACT

The average computer user needs to remember a large number of text username and password combinations for different applications, which places a large cognitive load on the user. Consequently users tend to write down passwords, use easy to remember (and guess) passwords, or use the same password for multiple applications, leading to security risks. This paper describes the use of personalized hand-drawn "doodles" for recall and management of password information. Since doodles can be easier to remember than text passwords, the cognitive load on the user is reduced. Our method involves recognizing doodles by matching them against stored prototypes using handwritten shape matching techniques. We have built a system which manages passwords for web applications through a web browser. In this system, the user logs into a web application by drawing a doodle using a touchpad or digitizing tablet attached to the computer. The user is automatically logged into the web application if the doodle matches the doodle drawn during enrollment. We also report accuracy results for our doodle recognition system, and conclude with a summary of next steps.

REFERENCES

• 1: Klein, D. "Foiling the cracker: A survey of, and improvements to, password security". In Proceedings of the 2nd USENIX Security Workshop, August 1990.
• 2: Joseph Goldberg , Jennifer Hagman , Vibha Sazawal, Doodling our way to better authentication, CHI '02 extended abstracts on Human factors in computing systems, April 20-25, 2002, Minneapolis, Minnesota, USA [doi>10.1145/506443.506639]
• 3: Ian Jermyn , Alain Mayer , Fabian Monrose , Michael K. Reiter , Aviel D. Rubin, The design and analysis of graphical passwords, Proceedings of the 8th conference on USENIX Security Symposium, p.1-1, August 23-26, 1999, Washington, D.C.
• 4: Moises Pastor , Alejandro Toselli , Enrique Vidal, Writing Speed Normalization for On-Line Handwritten Text Recognition, Proceedings of the Eighth International Conference on Document Analysis and Recognition, p.1131-1135, August 31-September 01, 2005 [doi>10.1109/ICDAR.2005.257]
• 5: R. N. Shepard. Recognition memory for words, sentences, and pictures. Journal of Verbal Learnings and Verbal Behavior, 6: 156--163, 1967.
• 6: U. Uludag, S. Pankanti, S. Prabhakar, and A.K. Jain, "Biometric Cryptosystems: Issues and Challenges," Proc. IEEE, vol. 92, no. 6, pp. 948--960, June 2004.
• 7: Varenhorst, C. "Passdoodles: A lightweight authentication method" http://oknet.csail.mit.edu/papers/varenhorst.pdf 2004
• 8: Isolated Handwritten Tamil Character Dataset hpl-tamil-iso-char, http://www.hpl.hp.com/india/research/penhw/resources/tamil-iso-char.html
• 9: H. Sakoe and S. Chiba, "Dynamic Progamming Optimization for Spoken Word Recognition", IEEE Trans. On Acoustics, Speech and Signal Processing, vol. 26, pp. 623--625, 19

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Input devices and strategies (e.g., mouse, touchscreen)

Additional Classification:
  K. Computing Milieux
  K.8 PERSONAL COMPUTING
      K.8.3 Management/Maintenance

General Terms:
Design, Experimentation, Human Factors

Keywords:
doodles, password management