Hello everyone this is Yasmeen Abdrabou from Bundeswehr university munich and today i'll be presenting our
ETRA full paper, GazeMeter: exploring the usage of gaze behavior to enhance password assessment
until now text-based passwords are still among the most commonly used authentication techniques
however, people are still not selecting strong passwords. It has been understood by the usable insecurity
community that there is a misconception for people what makes a strong password and this is actually
due to creation of password rules and policies that are inconsistent and misleading ultimately
resulting in such strong perception and for this different service providers employ password meters
to give an estimate of for the participants of their created password strength. However people until now
are still facing the situation where they create a password they thought to be strong and then
it's not accepted by the interface, showing that there is an inconsistency between both perceptions
and this demonstrates the need to develop a better mechanism to make users choose stronger passwords
we see particular potential in mechanism that not only take into account the actual strength
of the passwords but also how people perceive it and for this, let's differentiate between
actual password strengths like reflected by the password meter and the perceived password
strength by the participants and this table demonstrate the mismatch and implication of such
thing and here we have four dimensions if both the system and the user have the same
idea about the password to be strong or wait then there is no action needed actually here however it
gets more interesting if we go to the other the other side if the system sees the password to
be strong and the perceived password is weak then there is no harm caused here however it's a very
good opportunity to start teaching participants how to create strong passwords however it becomes
more problematic on the other side where the password is perceived to be strong and the system
perceives it to be weak here it's really useful not only to show participants how to
make strong pastors but also to enforce them to create one and in our work, our work is meant to
identify cases where actual password trend stands and perceives phosphorus strength are in odds
and since eyes are the window to the soul in this paper we investigate the use of gaze behavior as a
means to us as perceived password strength our approach is based on the assumptions that the
cognitive process while creating weak and strong passwords different and it's influencing it's
influencing a user's physiological response and behavior reflected in for example their gaze behavior
and for this, we did a lab proof of concept study admitted measures within-subject design
actually and we asked participants to create and enter 12 passwords six weeks and sit strong and
throughout our study we used to input modalities in laptop and smartphone and we used Tobii
eye tracker wearable eye tracker to collect users' gaze data and the reason for choosing two
input devices is to see whether our approach is generalizable across different input techniques
and we invited 15 participants to our lab and their aged between 22-31 and for the procedure when
they first entered the lab we asked them to sign in the content and demographics form and then we
calibrated the eye tracker using the one point calibration technique for you by Tobii
and then we asked participants to create weak and strong passwords balance it on a latin
square and after each one of them we ask them to rate it on a likert-scale from one to five
and throughout our study we had couple of variables and we had one independent variable
which is the input device laptop and smartphone and we had couple of dependent variables which we
tracked throughout the study which are for example gaze features, password entry duration, password
meters strength, rated password strength, and of course the created password by the participants
themselves for the results we started comparing the participants rated password strength to the
strength meter and we found we found difference between both however, this difference is not
statistically significant we also, we also checked the modality effect on the
password strength and we also did not find any statistical difference between participants
rated password and the meter rating for both weak and strong password this suggests that there
is no difference between the system-rated strength and our participants perceived
rated passwords estimate and in addition it also shows that the input model did not really
affect the strength of the passwords created in our study and furthermore next we tested
the effect of the input modality on the gaze features using ANOVA test we found that entering
weak passwords on laptops induced less fixations on the screen and more fixations on the
on the keyboard and also smaller pupil diameter on the smartphone and for strong passwords
entering strong passwords on laptop induced shorter fixations, longer saccades, and more fixation on
the keyboard as well as less fixation on the screen compared to the smartphone situation
and for to understand the influence of password trends on the gauge features we
also run the repeated measures ANOVA on the gaze features for both laptop and smartphone for
laptops we found that entering weak password on on the laptops induced longer fixation duration
shorter saccadic length, smaller pupil diameter, fewer fixations on the screen, and more fixations on the
keyboard however for the smartphone situation we did not find any statistical difference
or statistical effect of the password strength on the gaze behavior this might be due to the small
screen of the smartphone, hence less data collected and since we found
promising results from the statistical analysis we thought to run a machine learning model to see if we
can actually differentiate between both weak and strong passwords from users gaze behavior and
for this we run two classifiers user dependent and user independent classifiers and we did both
so we can understand if we can achieve better accuracy with the user dependent classifier or not
and in our analysis we compared between three different classific classifies svm,
random forst, and decision trees and we found that svm outperformed the other two classifiers
and we also found that it is possible to differentiate between weak and strong
passwords from users gaze behavior and we also found that user-dependent classifier outperformed
the user independent classifier and we reached an accuracy of 86% for the smartphone and 80%
for the laptop to differentiate between weak and strong passwords and for our work applications
our approach supports the design of novel interfaces that make people use stronger passwords
we can also use the knowledge of password strength for new concepts that for example
only allows users to register passwords if their strengths matches the sensitivity of the data that
needs to be protected and finally a future work can use our knowledge or our concept to
other knowledge based authentication techniques such as patterns and image based approaches
and finally to conclude in this work we introduced a novel approach of using gaze behavior as an
additional metric to assess password strength we ran a lab study on 15 participants and
we found that password strength is actually reflected in users as gay behavior and it is
possible to differentiate between weak and strong passwords with an accuracy of up to 86%
finally, our work enables research on mobile interfaces that consider
users understanding with the goal of making users choose strong passwords thank you for your attention