Abstract or Summary:
Graphical passwords have been proposed as an alternative to text passwords. These new authentication mediums are of much interest to researchers today due to their potential for usability and security. However, we must also consider new threats they may present. We are interested in the effects that visual attention and visual search have on the creation and maintenance of graphical passwords, and whether eye fixations can predict the location of these passwords. If eye fixations are good predictors, then the security of graphical passwords is considerably weakened.

Eye trackers, which detect eye movements on a screen, are becoming readily available. We hypothesize that gaze points gathered from any user could potentially be used to form an attack dictionary to guess other users’ graphical passwords. This may be possible because people tend to look at visual scenes in similar patterns. We conducted a lab study examining eye gaze patterns as users selected graphical passwords and then used this gaze data to form an attack dictionary. Surprisingly, we found that eye gaze is not a good predictor of passwords.