Protection aspects of iconic passwords on mobile devices

Abstract

Graphical passwords can replace alphanumeric passwords when the data entry device is not a keyboard, but a touchscreen instead, as is the case for modern mobile devices (smartphones and tablets). However, misinterpretations on the security of graphical passwords compared to textual ones can lead to insecure systems. This paper outlines a set of security best practices concerning the design of icon-based authentication mechanisms. The best practices have been derived from a behavioral study on the usability of a prototype. The paper also proposes methods for quality control and protection against brute force attacks against icon-based passwords. © 2012 Springer-Verlag.