Usability of a face-recognition based l...

A standard password or PIN could be easily spied out, e.g. by a quick glance over an owner's shoulder when the access code is entered, or by listening in to a conversation where the secret key is blabbed to another person. Graphical passwords, which are composed from images rather than letters or digits, are an elegant way to circumvent such trivial attacks, as arbitrary and perhaps complex images are much harder to memorize upon a momentary glimpse. With the human brain being evolutionary specialized on recognizing human faces (Pascalis and Kelly, 2009), why not use faces to form a pass-code?

To investigate the usability of such an alternative we conducted a series of field-trials with a prototype implementation of a graphical password authentication system, where participants had to select, memorize and recall a sequence of either three or four faces from a login-screen, which depicted twelve randomly assigned and synthetically generated faces. We conducted a quantitative statistical analysis to evaluate error rates. Our qualitative investigation showed - in line with the findings in previous research (e.g. Van Belle et al., 2010) - that in addition to the overall impression of the faces (physiognomy, etc.) a majority of respondents considered a number of biometric determinants to memorize and distinguish the faces used for our prototype. Furthermore we observed a strong willingness to accept face-recognition based authentication as an alternative to conventional passwords.