{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,5,21]],"date-time":"2024-05-21T21:40:17Z","timestamp":1716327617812},"reference-count":18,"publisher":"Wiley","issue":"12","license":[{"start":{"date-parts":[[2013,12,18]],"date-time":"2013-12-18T00:00:00Z","timestamp":1387324800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Concurrency and Computation"],"published-print":{"date-parts":[[2015,8,25]]},"abstract":"Summary<\/jats:title>Recognition\u2010based graphical passwords (RBGPs) are often proposed as an alternative user authentication mechanism. However, discussion of attack resistance often lacks quantitative examination. Establishing the efficacy of countermeasures could allow selection of an appropriate countermeasure for the level of security required by a given system. Furthermore, this information could be used to construct a model to estimate the number of intersection attacks required before success. This research contributes to these goals by establishing effective countermeasures and a model for intersection attacks. The approach involves creating a simulation of intersection attacks using five possible countermeasures and performing analysis to determine efficacy. Results show that using dummy screens does not increase the number of attacks required. It is also shown that increasing the number of challenge screens can increase and reduce the number of attacks required. Also presented is a model for RBGP schemes that can be used to estimate the number of intersection attacks required for a RBGP scheme when configuration values such as the number of challenge screens are known. This allows a quantitative choice of countermeasure for intersection attacks and a calculation that can provide a basis of comparison with other RBGP schemes, which was previously not possible. Copyright \u00a9 2013 John Wiley & Sons, Ltd.<\/jats:p>","DOI":"10.1002\/cpe.3196","type":"journal-article","created":{"date-parts":[[2013,12,18]],"date-time":"2013-12-18T12:24:29Z","timestamp":1387369469000},"page":"3089-3107","source":"Crossref","is-referenced-by-count":2,"title":["Simulating and modelling the effectiveness of graphical password intersection attacks"],"prefix":"10.1002","volume":"27","author":[{"given":"Rosanne","family":"English","sequence":"first","affiliation":[{"name":"School of Computing Science University of Glasgow Sir Alwyn Williams Building Glasgow G12 8QQ Scotland"}]}],"member":"311","published-online":{"date-parts":[[2013,12,18]]},"reference":[{"key":"e_1_2_6_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2013.07.001"},{"key":"e_1_2_6_3_1","unstructured":"ZezschwitzEV DunphyP LucaAD.Patterns in the wild: a field study of the usability of pattern and pin\u2010based authentication on mobile devices.Proceedings of Mobile HCI 2013 Security and Privacy Munich Germany 2013;261\u2013270."},{"key":"e_1_2_6_4_1","unstructured":"ZhaoZ AhnGj TechnologyGFS.On the security of picture gesture authentication on the security of picture gesture authentication.Proceedings of the 22nd USENIX Security Symposium Washington DC USA 2013;pp 383\u2013398."},{"key":"e_1_2_6_5_1","doi-asserted-by":"crossref","unstructured":"ChiangHY ChiassonS.Improving user authentication on mobile devices: a touchscreen graphical password.Proceedings of Mobile HCI 2013 Security and Privacy Munich Germany 2013;251\u2013260.","DOI":"10.1145\/2493190.2493213"},{"issue":"4","key":"e_1_2_6_6_1","doi-asserted-by":"crossref","DOI":"10.1145\/2333112.2333114","article-title":"Graphical passwords: learning from the first twelve years","volume":"44","author":"Biddle R","year":"2011","journal-title":"ACM Computing Surveys"},{"key":"e_1_2_6_7_1","unstructured":"DhamijaR PerrigA.Deja vu: a user study using images for authentication.Proceedings of the 9th Conference on USENIX Security Symposium\u2010Volume 9 USENIX Association Denver: Colorado USA 2000;4."},{"issue":"4","key":"e_1_2_6_8_1","first-page":"299","article-title":"Memory for words, pictures, and faces: retroactive interference, forgetting, and reminiscence","volume":"7","author":"Deffenbacher KA","year":"1981","journal-title":"Journal of Experimental Psychology: Human Learning and Memory"},{"key":"e_1_2_6_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2005.04.020"},{"key":"e_1_2_6_10_1","doi-asserted-by":"crossref","unstructured":"DunphyP HeinerAP AsokanN.A closer look at recognition\u2010based graphical passwords on mobile devices.Proceedings of the Sixth Symposium on Usable Privacy and Security Redmond WA USA 2010;1\u201312.","DOI":"10.1145\/1837110.1837114"},{"key":"e_1_2_6_11_1","doi-asserted-by":"crossref","unstructured":"De AngeliA CouttsM CoventryL JohnsonGI CameronD FischerMH.VIP: a visual approach to user authentication Proceedings of the working conference on advanced visual interfaces ACM: Trento Italy 2002;316\u2013323.","DOI":"10.1145\/1556262.1556312"},{"key":"e_1_2_6_12_1","doi-asserted-by":"publisher","DOI":"10.1142\/S0218001409007430"},{"key":"e_1_2_6_13_1","volume-title":"Intro Stats","author":"De Veaux RD","year":"2006"},{"key":"e_1_2_6_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-5525-8"},{"key":"e_1_2_6_15_1","doi-asserted-by":"crossref","DOI":"10.1093\/oso\/9780195315103.001.0001","volume-title":"Basic Statistics: Understanding Conventional Methods and Modern Insights","author":"Wilcox RR","year":"2009"},{"key":"e_1_2_6_16_1","volume-title":"Data Analysis and Graphics Using R","author":"Maindonald J","year":"2010"},{"key":"e_1_2_6_17_1","volume-title":"An R and S\u2010Plus Companion to Applied Regression","author":"Fox J","year":"2002"},{"key":"e_1_2_6_18_1","volume-title":"Robust regression. An R and S Plus Companion to Applied Regression","author":"Fox J","year":"2002"},{"key":"e_1_2_6_19_1","unstructured":"CharrauD FurnellSM DowlandPS.PassImages: an alternative method of user authentication.Proceedings of 4th Annual ISOneWorld Conference and Convention Las Vegas USA 2005."}],"container-title":["Concurrency and Computation: Practice and Experience"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fcpe.3196","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/cpe.3196","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,21]],"date-time":"2024-05-21T21:07:13Z","timestamp":1716325633000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/cpe.3196"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013,12,18]]},"references-count":18,"journal-issue":{"issue":"12","published-print":{"date-parts":[[2015,8,25]]}},"alternative-id":["10.1002\/cpe.3196"],"URL":"https:\/\/doi.org\/10.1002\/cpe.3196","archive":["Portico"],"relation":{},"ISSN":["1532-0626","1532-0634"],"issn-type":[{"value":"1532-0626","type":"print"},{"value":"1532-0634","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013,12,18]]}}}