Facelock: familiarity-based graphical authentication.

Area of Science:

• Human-computer interaction
• Cognitive psychology
• Biometric security

Background:

• Traditional authentication methods like passwords and PINs present memory recall challenges.
• Security is often compromised when users resort to writing down codes.
• Existing authentication systems lack robust defenses against social engineering attacks.

Purpose of the Study:

• To introduce and evaluate a novel knowledge-based authentication system called 'facelock'.
• To leverage the psychological distinction between familiar and unfamiliar face recognition for secure access.
• To assess the system's effectiveness against various attack vectors and user memory load.

Main Methods:

• Two studies were conducted to test the 'facelock' system.
• Study 1 involved users authenticating by identifying familiar faces among distractors.
• Study 2 simulated shoulder-surfing attacks using varied facial image presentations.

Main Results:

• High authentication success rates for account holders (97.5% initially, 86.1% after one year).
• Significantly low success rates for unauthorized users, including zero-acquaintance (<1%) and personal attackers (6.6%).
• Effective defense against shoulder-surfing attacks (1.9% success rate).

Conclusions:

• Familiar face recognition offers a viable, low-memory-load alternative to traditional authentication.
• The 'facelock' system demonstrates strong security against both novice and informed attackers.
• The contrast between familiar and unfamiliar face perception is a promising foundation for next-generation graphical authentication systems.