Hi, I’m Argyris Constantinides, and I’m a PhD student in the Department of Computer
Science at the University of Cyprus.
In this talk, I’m interested in the effects of culture towards users’ interactions in
picture passwords.
This work is partially supported by the EU Horizon 2020 Serums project, which is a project
about Securing Medical Data in Smart Patient-Centric Healthcare Systems.
In the context of Computer Security, there is a need for balancing security and usability,
which emerges from contradictory requirements posed by different stakeholders.
On the one hand, we have the security experts and service providers who increase the security
levels of user authentication policies.
On the other hand, we have the end-users who demand transparent
and usable authentication solutions.
I’d also like to make this statement: “The only secure password is the one you cannot remember.“
Let me explain this. This password is considered to be strong enough, but not so memorable.
Even so, if it has been previously cracked and is now publicly available,
it can not be considered as a strong password anymore.
Limitations of human memory, as well as strong security policies, make it impossible for
most users to cope with multiple, strong and memorable passwords.
So, what do users do? They often employ workarounds that violate security policies such as:
Reuse the same password across multiple accounts, share passwords with other users, or write their
passwords down to paper or text files.
Now, an alternative form of user authentication that has received increasing attention
is picture passwords.
These schemes leverage the picture superiority effect, which refers to the phenomenon where
people are able to remember pictures better than text, and are widely adopted by researchers
as they leverage on new interaction capabilities.
Such an example is Picture Gesture Authentication introduced in Windows 8, which requires users
to draw gestures (such as circles, lines and taps) on a background image to authenticate,
and the image acts as an external cue to assist users during login.
With regards to the picture password mechanism, the longest dimension of the image is divided
into 100 segments,
and then, the shortest dimension is divided on the same scale to create the grid upon
which we can draw gestures. However, prior works revealed that various
pictures are susceptible to hotspots, which are basically points that attract users to
select them and often lead to easily predictable passwords.
Now, taking into consideration that the task of creating a picture password is
a perceptual process through the human visual system,
and that people across diverse cultures exhibit differences in picture perception
In this work, we investigate whether there are cultural differences in visual processing,
comprehension and exploration of the picture content within Picture Passwords.
To do so, we conducted a controlled cross-cultural lab study.
We invited individuals to interact with a picture password scheme we implemented, that
first required them to create a picture password.
Regarding the method of the study, we followed a between-subject design and we recruited 67
participants; 36 of them living in Shanghai, China, and 31 living in Nicosia, Cyprus.
The study involved the following steps: First, participants were introduced to a demonstration
page to familiarize themselves with the process of drawing gestures on an image.
Then, they were requested to select one image from a set of 9 images, on which they created
their picture password by drawing three gestures. After confirmation of their picture password,
they got access to a real-life service.
We measured the time required to explore picture content
before password creation, the time required to login,
password selections falling into hotspots segments,
and likeability and engagement with the picture content.
To control participants’ familiarity with the picture semantics, we intentionally chose
two specific picture sets.
The first set consisted of 9 Culture-internal pictures. These pictures illustrate sceneries
that are highly related to the participants’ sociocultural experiences from their daily
life context within the University campus. An example picture from the culture-internal
set is shown on the top left of the screen.
The second set consisted of 9 Culture-external pictures. These pictures illustrate the same
daily-life experiences, but in a different sociocultural context (such as, sceneries
from the University of a different culture) to avoid users being familiar with a scenery.
An example picture from the Culture-external set is shown on the bottom right of the screen.
With regards to the time required to explore the picture content before making password
selections, we found that there was an interaction effect
between Culture Group and Picture Type. In particular, the Eastern group that utilized
Culture-internal picture type spent more time than the Western group.
With regards to the time required for the first login attempt,
we found that the Eastern group was significantly slower than the Western group.
With regards to the password selections falling into hotspots segments,
we found that the proportion of hotspots selections was significantly higher for the Culture-external
picture type than the Culture-internal picture type.
Finally, with regards to the likeability and engagement with picture content, we conducted
semi-structured interviews at the end of picture password creation.
Example questions included: ”What strategy did you follow to create your password?
and “What type of background picture would you prefer?”
We found that the Culture-internal pictures influence positively users' selections
and that users prefer pictures that are related to their personal
experiences and their culture.
To wrap up, we showed that people across diverse cultures exhibited differences in visual processing,
comprehension, and exploration of pictures prior to making their password selections.
Qualitative data also triangulate the findings by revealing the likeability and users’
engagement with picture content related to their culture.
Such knowledge will allow us to move from the “one-size-fits-all” approach to a
more personalized approach. We envision a framework that targets to deliver “best-fit”
picture content during password creation, tailored to users’ cultural background and
unique sociocultural experiences.
That's pretty much it. Thank you for your attention.