Improving memorability using Emojis in a shoulder surfing resistant authentication method

Mohamed Mahrous Mahrous Amer; Yvonne Hwei-Syn Kam; Aiman Hussein Elkhedrawi

doi:10.12688/f1000research.73691.1

Home Browse Improving memorability using Emojis in a shoulder surfing resistant...

ALL Metrics

Views

Downloads

Get PDF

Get XML

Export

▬

✚

Research Article

Improving memorability using Emojis in a shoulder surfing resistant authentication method

[version 1; peer review: 1 approved with reservations, 1 not approved]

Mohamed Mahrous Mahrous Amer¹, Yvonne Hwei-Syn Kam ¹, Aiman Hussein Elkhedrawi¹

PUBLISHED 29 Mar 2022

Author details Author details

¹ MMU Cyberjaya, Cyberjaya, Selangor, Malaysia

Mohamed Mahrous Mahrous Amer
Roles: Conceptualization, Data Curation, Investigation, Methodology, Project Administration, Resources, Software, Validation, Visualization, Writing – Original Draft Preparation, Writing – Review & Editing

Yvonne Hwei-Syn Kam
Roles: Conceptualization, Formal Analysis, Funding Acquisition, Investigation, Methodology, Project Administration, Supervision, Validation, Visualization, Writing – Original Draft Preparation, Writing – Review & Editing

Aiman Hussein Elkhedrawi
Roles: Resources, Validation, Visualization, Writing – Review & Editing

OPEN PEER REVIEW

REVIEWER STATUS

This article is included in the Research Synergy Foundation gateway.

Abstract

Background: Emojis are icons that are familiar and fun to add pizzazz and colour to communication. They have also been used in authentication where the emojis form memorable pictogram story-like passwords. Emojis, which are graphical, are in general vulnerable to shoulder surfing attacks (SSAs). This paper studies whether graphics such as emojis offer better memorability than numerics when implemented in a shoulder-surfing resistant authentication method. Thus, the proposed method aims to meet both needs of being shoulder-surfing resistant as well as being memorable.
Methods: In this paper, a SSA resistant method (DragPIN) is used as a reference system on which to implement emojis in place of numerics. Additionally, a new feature, cue questions was implemented for added security. In the proposed method, users composed emoji-based stories using personalised cue questions that served as memory aids. Moreover, these self-chosen cue questions were less comprehensible to shoulder-surfing observers. There were two variants of the DragPIN method, manual and automatic-sliding. To compare the differences, both the reference configuration and modified versions based on the proposed method were implemented. Thirty people participated in user testing. A pre- and post-survey appraised user experience. User testing and survey on both methods and their variants for performance, memorability, and usability were performed.
Results: All implementations successfully resisted shoulder surfing. The time taken for login in the manual variant using the proposed methodology was shorter than using the reference method. After four to six weeks, login performance taking into account intermediate failures was better for the proposed method (86.7-91.7%) than the reference method (76.7-78.3%). Hypothesis testing also showed significance in the results. This could point to higher memorability in the proposed method.
Conclusion: The study provides testing of emoji-based compared to PIN-based implementation in authentication. Emoji-based stories may form memorable passwords while personalised cue questions may aid memorability.

Keywords

Graphical Authentication System, PIN, Password, Emoji, Shoulder Surfing

Corresponding author: Yvonne Hwei-Syn Kam

Competing interests: No competing interests were disclosed.

Grant information: This work was supported by the IRFund grant [grant number MMUI/210071], Multimedia University, Malaysia.

Copyright: © 2022 Amer MMM et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

How to cite: Amer MMM, Kam YHS and Elkhedrawi AH. Improving memorability using Emojis in a shoulder surfing resistant authentication method [version 1; peer review: 1 approved with reservations, 1 not approved]. F1000Research 2022, 11:362 (https://doi.org/10.12688/f1000research.73691.1) First published: 29 Mar 2022, 11:362 (https://doi.org/10.12688/f1000research.73691.1) Latest published: 29 Mar 2022, 11:362 (https://doi.org/10.12688/f1000research.73691.1)

Introduction

In general, graphical passwords are more memorable than text passwords because of the picture superiority effect.¹^–³ Graphical authentication has been a widely researched topic. At the time of writing this paper, 1,090 articles were retrieved by Google Scholar with the search terms “shoulder-surfing” and “graphical authentication”.

There was an uptrend of publications from 2012 to 2017 which plateaued until 2020⁴ (Figure 1), with mean citations of 15.18 per paper. In dimensions.ai⁴ the search phrase involving combinations of “emoji”, “picture”, “password” and “authentication” retrieved 587 publications.

Figure 1. Trend of picture/emoji-based authentication.⁴

Literature review

Table 1 shows a comparison of previous works. Emojis have been used in authentication⁵ but are in general more vulnerable to shoulder surfing attacks (SSAs). DragPIN⁶ and the methods in⁷^,⁸ are resistant to SSA. The automatic sliding variant implemented by DragPIN has the advantage of the display not being static, so the displayed state may not necessarily correspond to the password, which makes it shoulder surfing resistant. However, methods⁷^,⁸ are vulnerable to intersection attacks after multiple recorded observations. DragPIN is resistant to SSAs but uses numbers, which are less memorable than pictures. EmojiAuth⁵ is not SSA resistant but uses emojis, which are more memorable.

Table 1. Comparison of related works.

Reference	Resistance to SSA
Srinivasan⁶	Yes (auto-sliding variant)
Salman Wang, & Li⁷	Vulnerable to intersection attack
Kasat & Bhadade.⁸	Vulnerable to intersection attack
Golla, Detering, & Dürmuth⁵	No

Both methods have strengths and disadvantages. Therefore, a modified DragPIN that uses emojis instead of digits addresses both systems’ drawbacks as well as maintaining their respective advantages.

Methods

DragPIN and EmojiAuth

A DragPIN prototype was constructed for testing. A signup screen, as shown in Figure 2, allows a user to create a login and register a 4-digit pin. Users could sign in by choosing either the manual or automatic tabs (Figure 3). Conceptually, the implementation (shown in Figure 3) is similar to the original DragPIN.⁶

Figure 2. DragPIN prototype signup page.

Figure 3. DragPIN implementation.

Figure 3 shows the DragPIN interface implementation. A prototype for EmojiAuth was also made: the signup page and login screen with an emoji keyboard are shown in Figures 4 and 5, respectively. Unlike the implementation in the original DragPIN, which had only a choice of 20 emojis, the prototype allowed users to make use of a wider set of emojis.

Figure 4. EmojiAuth prototype sign in.

Figure 5. Emoji Keyboard.

Proposed method – EmojiSlide

Operation

In this section, we will describe how the software works. We implemented EmojiSlide (the proposed method) and DragPIN (the reference method) as a web application. All the dependencies required to run the source code are managed by Pipenv version 2020.11.15. The software is provided in the repository as mentioned under the Software availability section. Installation instructions are included in the README.md file archived in release v0.1-beta in the repository. Memory (RAM) 512 MB and 1× CPU cores are the minimum system requirements. Django was the framework used to build this web application. Figure 6 describes the flow of the web application that was used to evaluate the differences between DragPIN and the proposed method (EmojiSlide).

Figure 6. Flow diagram.

At the start of the program, the user will be prompted to select the authentication method desired, either EmojiSlide or DragPin. Thereafter, users will have two options, which are login or sign up. If the user navigates to the signup page in DragPIN or Emoji-Auth, an empty form is generated and passed to the frontend. The form data received by the backend via POST HTTP request is validated and the user profile is saved in the database, following which users may use their credentials to log in via the earlier chosen method.

The proposed method uses emojis instead of numerics in the reference method, DragPIN. The user registers two 4-emoji passwords. For each 4-emoji password, the system generates six other random emojis, for a total of ten emojis. The set of these ten emojis is the challenge set. The challenge set forms the table (column) indexes used in authentication (shown in Figure 10). The challenge set is fixed per user. This ensures that a user's password cannot be deduced from observing the emojis displayed upon subsequent reloading of the challenge webpage.

To increase memorability and security, cue questions were introduced (Figure 7), which were not present in DragPIN. Users wrote a cue question for each emoji password which also served as the password prompt. Resistance to SSA is increased by having randomly chosen cue questions. Each user must register two cue questions and two passwords, each of which consists of four emojis.

Figure 7. Cue question registration.

The proposed method was designed as a web application called EmojiSlide.⁹

The username entry page is shown in Figure 8.

Figure 8. Sign-in page of the proposed method.

Figure 9 shows that a security measure to prevent Cross Site Request Forgery (CSRF) has been implemented. A CSRF Token is a private, unique, and unpredictable value generated by a server-side application to protect CSRF-vulnerable resources. When the later request is made, the server-side application checks that it has the expected token and rejects it if it is absent or incorrect.

Figure 9. Sign-in page with a Cross Site Request Forgery (CSRF) token.

After entering the username, the authentication screen is shown. During authentication (Figure 10), a user chooses either the manual or automatic sliding scheme. The procedure is similar to DragPIN, except that the digits have been replaced with emojis. Figure 10 shows the manual scheme. As an example, the user's emoji password is , , , . The login process is started by the user mentally choosing an alphabet from the available alphabets. Let the chosen alphabet be ‘D’. One of the D’s in each row is aligned with the password emojis in the correct sequence. The icons look slightly different in Figure 10 due to emojis being customized on different platforms.

Figure 10. Proposed manual implementation.

Figure 11 shows the automatic sliding variant. The same emoji password example is used. The space bar was used to capture the moment the sliding marker ‘B’ aligned with the password emoji. The “enter” key commenced the sliding of the next row. In this instance, the user pressed the spacebar during alignment and pressed the “enter” key after the marker had slid beyond the password emoji. As a result, the letter ‘B’ was no longer aligned with the password emoji. This misalignment resists SSA.

Figure 11. Proposed automatic implementation.

User test study

Ethical considerations

Ethics approval was obtained from the ethics committee of the Multimedia University for the research (approval number EA04420201). The demographics chosen was university students and adults (>18 years old). These would likely be using authentication daily in their lives and have experience with different methods of authentication. An invitation message was sent to potential participants who were acquaintances of the authors. The participants were mostly students in MMU, with a few working adults. The invitation included a website link to a presurvey. Consent was implicit as participants would answer this survey and submit their email if they chose to participate in further testing. No monetary reward was given for participation.

Between 30 to 100 participants is considered a medium-sized sample (Bošnjak & Brumen, 2020). In a review of authentication methods (Binbeshr et al, 2021), most of the user studies (51 out of 55 articles) had between 10 to 50 participants, with 30 being the most common. Thus, in the experiments conducted, the chosen number of participants was 30 or more.

Presurvey

Several questions were chosen in the presurvey to gain insight into the users’ willingness to use emojis as password characters. The survey consisted of six questions (Box 1).

Box 1. Pre-survey questions.

1. On a scale of 0 to 5, 5 being strong and 0 being weak, how strong do you think your password is?

2. How would you rate your ability to recall this password?

3. Would you consider using emojis as your password?

4. Use 6 to 10 emojis only to tell a story about yourself. mine would be: “”

5. How would you rate your ability to recall this emoji story?

6. Would you still consider emojis as a password?

User testing of EmojiSlide

User testing was done in two phases. Phase 1 tested for login accuracy and time taken, as well as SSA resistance. Phase 2 tested for memorability by measuring login accuracy. Participants in phase 2 were the same as those in phase 1 to achieve reliable memorability statistics.

Phase 1

In phase 1, participants with ages ranging from 18 to 40 were invited to a Google meeting, which was recorded for further evaluation of the scheme’s capability to resist SSA. EmojiSlide’s motivations were briefly described. Then a test user was created. The participant (user) then learned how to login, using each of the variants in both the proposed and reference methods (EmojiSlide Manual, EmojiSlide Auto-sliding, DragPIN Manual, and DragPIN Auto-sliding). After familiarisation, users then registered and attempted to authenticate in each variant. Participants were given three attempts to login. The time taken for a successful authentication attempt was recorded. A usability survey on the proposed method was given after completion. Shoulder surfing was performed on video recordings of user logins. Four "shoulder surfers” went through the familiarisation procedure as described before attempting SSA.

A survey was provided to the participants (the questions can be found in Box 2). Questions 3 to 6 used a Likert scale. The first three questions were for gathering demographic information. The remaining questions were used to ascertain users’ experience with the proposed method.

Box 2. Post-survey questions.

1. What is your age group?
2. What is your occupation?
3. How computer savvy are you?
4. How would you rate your overall experience?
5. How hard was it to recall your emoji password compared to a textual password?
6. Would you trust this system to prevent a shoulder surfer?

System usability survey

At the end of the phase 1 experiment, the participants were given a System Usability Survey (SUS) which is a Likert scale (shown in Box 3). Each question’s response was converted to points and the result was graded according to Ref. 10.

Box 3. System usability survey.

1. I think that I would like to use this system frequently.
2. I found the system unnecessarily complex.
3. I thought the system was easy to use.
4. I think that I would need the support of a technical person to be able to use this system.
5. I found the various functions in this system were well integrated.
6. I thought there was too much inconsistency in this system.
7. I would imagine that most people would learn to use this system very quickly.
8. I found the system very cumbersome to use.
9. I felt very confident using the system.
10. I needed to learn a lot of things before I could get going with this system.

Phase 2

In phase 2, held 4-6 weeks later, the same users from phase 1 were invited to re-login to test for password memorability.

Significance testing

Hypothesis testing was performed to compare the differences between EmojiSlide(E) with DragPIN (DP) in both manual (m) and auto (a) variants. The software used was Microsoft Excel version 2011. The factors for comparison are the time taken for login, t and the mean number of intermediate failures, f. The null hypotheses are that there are no differences. The method’s name and variant form the subscript in Table 4, e.g. the time taken for Emojislide manual is t_Em. For statistical analysis of results, we applied paired t-tests. A p value of p < 0.05 was considered statistically significant.

Results and discussion

The datasets for the user results are available as Underlying data.¹¹^–¹³

Presurvey

A total of 50 participants took part in the presurvey. The questions were not compulsory to answer thus not all questions had 50 responses. In the presurvey, participants were asked to create an emoji story about themselves using six to ten emojis. For question no. 3, ‘Would you consider using emojis as your password?’ (n = 50) about 72% answered Yes or “I am not sure”, and one person (2%) gave a comment about the possibility of emoji passwords being guessed, while 26% answered No (Figure 12). To ascertain their answer with practical experience, those who did not answer “No” went on to create their emoji stories in question 5. After creating emojis, (n = 37) answered the repeated question of ‘Would you still consider using emojis as your password?’ (question 6). Only 1 person answered No, indicating that there was a willingness to try using emoji passwords.

Figure 12. Initial feedback on emoji password acceptance.

The respondents who created their emoji stories (n = 37) also rated their ability to recall the emoji story they created on a scale of 0 = weak and 5 = strong (Figure 13). Option ‘5’ had the highest number of responses, indicating that most respondents felt confident of their ability to remember their emoji password.

Figure 13. Initial feedback on the memorability of Emojis.

User testing of EmojiSlide

A total of 30 participants took part in user testing. Figure 14 shows the age groups: most participants were aged 20-30 years old (76.7%). Table 2 shows the demographics of the participants.

Figure 14. Participants age groups.

Table 2. Participant demographics of the user testing study.

Categories	Percentage %
Males	66.66
Females	33.33
Graduates/Employed	26.67
Undergraduates	73.33
Computer savvy users	26.66
Average computer users	53.33
Non-frequent computer users	20

Table 3 shows the average time taken to login for successful attempts. Users logged in slightly faster using EmojiSlide (proposed method) compared to DragPIN. Results also showed that login to auto-sliding variants took longer than the manual variants.

Table 3. Time taken for login.

Parameters	Average login time of successful attempts, seconds (s)
DragPIN Manual	19.3
DragPIN Automatic	30.1
EmojiSlide Manual	16.7
EmojiSlide Automatic	29.5

Post experiment, users were requested to state whether they would trust the system to resist SSA. Figure 15 shows that 76.7% answered yes, 23.3% were unsure and none answered no, showing that the system was judged capable by most participants.

Figure 15. Users’ perception of the proposed method’s ability to resist SSA.

None of the shoulder surfers were able to get any full PIN or emoji password. They commented that slowing or reversing the recorded videos availed little, especially for the automatic variants. They were only able to obtain two emojis, from three users, which was due to those users pointing their mouse cursor at their desired emoji. All participants logged in successfully within three attempts (100% login accuracy). Most of the mistakes occurred during phase 1, for the DragPIN auto variant where three participants used three login attempts to login.

Figure 16 shows the average successful login rates when the number of intermediate failures before succeeding is taken into account. If a successful login takes one attempt (0 failures), the success rate = 100%, if it takes two attempts (1 failure), the success rate = ½ or 50% and if three attempts (2 failures), success rate = 1/3 or 33.33%. This is calculated per user. The average success rate is shown in Figure 16.

Figure 16. Phase 1 and phase 2 average success rate (including intermediate failures).

After 4-6 weeks, the login accuracy for both the auto sliding and manual variants ranged between 76.7-78.3% for the reference method and 86.7-91.7% for the proposed method.

Significance testing

Referring to Table 4, the null hypothesis for (1) is that there are no differences in the mean login time between the manual EmojiSlide (E) & DragPIN (DP). The t-test gives t(29) = 2.13, p = 0.04, which shows that the mean login time differs. The mean login time is shorter for the EmojiSlide. However, for (2), the time differences between the autosliding versions of E & DP were not significant.

Table 4. Sets of hypotheses.

Set	H₀	H₁	Number of tails
1. Login time manual	t_Em = t_DPm	t_Em ≠ t_DPm	2
2. Login time auto	t_Ea = t_DPa	t_Ea ≠ t_DPa	2
3. Number of failures manual	f_Em = f_DPm	f_Em < f_DPm	1
4. Number of failures auto	f_Ea = f_DPa	f_Ea < f_DPa	1

The null hypotheses for (3) and (4) are that there are no differences in the number of intermediate failures (during Phase 1) in the manual and auto EmojiSlide and DragPIN versions respectively, while the alternative hypotheses are that the EmojiSlide versions have fewer failures. The one tailed t-test for manual variants (3) gave t(29) = 1.99, p = 0.028. The auto versions (4) had t(29) = 2.25, p = 0.016. In Phase 2, hypothesis set (3) gave t(29) = 2.11, p = 0.02 but in hypothesis set (4), the null hypothesis was not rejected. Thus, in Phase 1, EmojiSlide (manual and auto) had a lower number of failures compared to DragPIN, and this trend continued in Phase 2 for the manual variant.

This suggests higher memorability in the proposed method. The login accuracy was higher even though the users had two sets of emoji passwords to remember versus one PIN.

System usability survey

The SUS showed that the average score per user was 88.5% (Excellent). The score distribution is shown in Figure 17.

Figure 17. System usability testing results.

Limitations and future improvement

As the emoji-based implementation was based on one method, whether the memorability gains will extend to other authentication methods is yet undiscovered. Also, the sample comprised mostly young people thus the effect on older adults was not tested. Larger scale testing with a higher number and variety of participants can provide more insight. One of the system’s future upgrades is the use of the most recent version of emojis.

Conclusion

In this paper, a graphical authentication method was proposed where emojis were used in place of numerics and cue questions were added. Results indicate the proposed method and reference method resisted SSA where no passwords were compromised. Passwords remained memorable after 4-6 weeks where the proposed method had a login accuracy of 86.7-91.7% compared to 76.7-78.3% for the reference method. The results indicate that the use of emoji-based stories may have higher memorability than numbers. Personalized cue questions may also aid memorability.

Data availability

Underlying data

Figshare: Using Emojis in a Shoulder-surfing Resistant Authentication Method, Pre-survey.csv. (Pre-survey results.). https://doi.org/10.6084/m9.figshare.14872062.v1.¹¹

Figshare: Using Emojis in a Shoulder-surfing Resistant Authentication Method, Phase1&2.csv. (User testing results). https://doi.org/10.6084/m9.figshare.17163470.v1.¹²

Figshare: Using Emojis in a Shoulder-surfing Resistant Authentication Method, SUS.csv (System Usability Survey results.). https://doi.org/10.6084/m9.figshare.14872059.v1.¹³

Data are available under the terms of the Creative Commons Attribution 4.0 International license (CC-BY 4.0).

Software availability

Source code for EmojiSlide available from: https://github.com/mahrous-amer/FYP/tree/v0.1-beta

Archived source code at the time of publication: https://doi.org/10.5281/zenodo.5574387⁹

Licence: MIT

Grant information

This work was supported by the IRFund grant [grant number MMUI/210071], Multimedia University, Malaysia.

Acknowledgments

An earlier abridged version of this work was presented at the iCatse International Conference on IT Convergence and Security 2021.¹⁴

References

1. Paivio A, Csapo K: Picture superiority in free recall: Imagery or dual coding?. Cogn. Psychol. 1973 Sep.; 5(2): 176–206. Publisher Full Text
2. Biddle R, Chiasson S, Van Oorschot PC: Graphical passwords: Learning from the first twelve years. ACM Comput. Surv. September 2013; 44(4). ISSN 0360-0300. Publisher Full Text
3. Snodgrass JG, Asiaghi A: The pictorial superiority effect in recognition memory. Bull. Psychon. Soc. 1977 Jul.; 10(1): 1–4. Publisher Full Text
4. Emoji authentication In publications—Dimensions: n.d. Retrieved September 1, 2021. Reference Source
5. Golla M, Detering D, Drmut M: Emojiauth: quantifying the security of emoji-based authentication.2017. Publisher Full Text
6. Srinivasan R: DragPIN: A secured PIN entry scheme to avert attacks. Int. Arab J. Inf. Technol. 2018.
7. Salman M, Li Y, Wang J: A graphical pin entry system with shoulder surfing resistance. 2019 IEEE 4th International Conference on Signal and Image Processing (ICSIP). 2019. Publisher Full Text
8. Kasat OK, Bhadade U: Revolving flywheel pin entry method to prevent shoulder surfing attacks. 2018 3rd International Conference for Convergence in Technology (I2CT). 2018. Publisher Full Text
9. Amer M: mahrous-amer/FYP: EmojiSlide-Prototype (v0.1-beta). Zenodo. 2021. Publisher Full Text
10. Bangor A, Kortum P, Miller J: Determining what individual SUS scores mean: Adding an adjective rating scale. J. Usability Stud. 2009; 4(3): 114–123.
11. Amer M: Pre-survey.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text
12. Amer M: Phase1&2.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text
13. Amer M: SUS.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text
14. Amer MM, Kam YH, Goh VT: A Study on Using Emojis in a Shoulder Surfing Resistant Authentication Method. Lecture Notes in Electrical Engineering 2021.

Comments on this article Comments (0)

Version 1

VERSION 1 PUBLISHED 29 Mar 2022

Author details Author details

¹ MMU Cyberjaya, Cyberjaya, Selangor, Malaysia

Aiman Hussein Elkhedrawi
Roles: Resources, Validation, Visualization, Writing – Review & Editing

Competing interests

No competing interests were disclosed.

Grant information

This work was supported by the IRFund grant [grant number MMUI/210071], Multimedia University, Malaysia.

Article Versions (1)

version 1

Published: 29 Mar 2022, 11:362

https://doi.org/10.12688/f1000research.73691.1

© 2022 Amer MMM et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Download

Export To

metrics

	Views	Downloads
F1000Research	-	-
PubMed Central Data from PMC are received and updated monthly.	-	-

Citations

SEE MORE DETAILS

CITE

how to cite this article

Amer MMM, Kam YHS and Elkhedrawi AH. Improving memorability using Emojis in a shoulder surfing resistant authentication method [version 1; peer review: 1 approved with reservations, 1 not approved]. F1000Research 2022, 11:362 (https://doi.org/10.12688/f1000research.73691.1)

NOTE: If applicable, it is important to ensure the information in square brackets after the title is included in all citations of this article.

track

receive updates on this article

Track an article to receive email alerts on any updates to this article.

Open Peer Review

Version 1

VERSION 1

PUBLISHED 29 Mar 2022

Views

Reviewer Report 02 Feb 2023

Nur Haryani Zakaria, School of Computing, Universiti Utara Malaysia, Kedah, Malaysia

Not Approved

https://doi.org/10.5256/f1000research.77360.r159005

Summary:
The research work proposed an enhancement of DragPIN scheme using Emojis instead of numerical characters and claimed to be shoulder surfing resistant. The proposed scheme rely on personalized cue questions to aid memorability. The experiment conducted to evaluate the proposed scheme against referenced scheme (i.e.: DragPIN) using 2 variants (manual and auto-sliding). Findings indicate that the proposed scheme has better performance and to certain extend improved users’ memorability.

Is the work clearly and accurately presented and does it cite the current literature?
The manuscript did not provide an adequate review of the literature on what was the main issue that motivate the study to be carried out. According to my understanding, the work is proposing an enhancement to existing DragPIN scheme by leveraging the usage of Emojis (as being used in EmojiAuth). Limitation of the existing schemes should be highlighted clearly and what are targeted enhancement that the study intended to achieve.

Is the study design appropriate and is the work technically sound?
The design of the study seems inappropriate and was not written neatly. The flow of sections did not provide good understanding in terms of the procedures that were taken throughout the experiment. For example, it was not clear in terms of the differences between manual and auto-sliding version. Why is it necessary to have these two variants? It was also not clear how the “shoulder surfers” was selected? Are they part of the 30 participants recruited? Measurements used for the parameters were not mentioned clearly. For example, how do you consider a successful or failure of shoulder surfing act? How do you measure the success of login rate versus failure rate?

Are sufficient details of methods and analysis provided to allow replication by others?
I think the Methodology section need to be revised. It should remove the discussion proposed method and the CSRF security to other section. These two are not part of the method. Protocol of the experiment was not listed and elaborated which makes it difficult to follow and what more to replicate.

If applicable, is the statistical analysis and its interpretation appropriate?
The hypotheses of the study were not listed properly which makes it difficult to comprehend the findings. Majority of the statistical analysis was done descriptively which only reports on frequency (percentages basis). T-test was used to measure the hypotheses testing but then again, since hypotheses statements is missing, it would be difficult to comprehend the findings.

Are all the source data underlying the results available to ensure full reproducibility?
The source of data was shared but then again it is challenging to follow the write-up of the manuscript since the sections need to be revised accordingly to fix the coherence aspect.

Are the conclusions drawn adequately supported by the results?
It is difficult to agree with the conclusion drawn when authors did not clearly mention how the parameters were measured. It was mentioned earlier in my comment above about how the protocols of the experiment was conducted? How about the measures taken for the success and failures of login accuracy.

Other comments
In general, the manuscript needs to be rewritten to improve the quality of the write-up. At its current stage, it is difficult to follow the narrative of the manuscript that can assist readers’ understanding of the study being carried out. I would encourage the author(s) to resubmit again the manuscript after considering the comments and suggestions given.

Is the work clearly and accurately presented and does it cite the current literature?

Partly
Is the study design appropriate and is the work technically sound?

Partly
Are sufficient details of methods and analysis provided to allow replication by others?

Partly
If applicable, is the statistical analysis and its interpretation appropriate?

Partly
Are all the source data underlying the results available to ensure full reproducibility?

No
Are the conclusions drawn adequately supported by the results?

No

Competing Interests: No competing interests were disclosed.

Reviewer Expertise: Information security

I confirm that I have read this submission and believe that I have an appropriate level of expertise to state that I do not consider it to be of an acceptable scientific standard, for reasons outlined above.

CITE

Report a concern

Respond or Comment

Views

Reviewer Report 13 Apr 2022

Gerard Bastiaan Remijn, Faculty of Design, Department of Human Science, Kyushu University, Fukuoka, Japan

Approved with Reservations

https://doi.org/10.5256/f1000research.77360.r129237

The authors implemented and tested the use of Emojis in a shoulder-surfing resistant authentication method (“DragPIN”). Users were asked to construct a PIN-like password consisting of a series of emojis, and they could use personalized cue questions to aid memorability of the series. Shoulder surfing resistance was tested under a manual input condition and an automatic-sliding method, while login time and memorability were tested against the original (numerical input) method. Results showed that both the new implementations indeed were shoulder-surfing resistant and that manual login for both methods was faster than automated login. Login performance after 4-6 weeks was better for the emoji method, which the authors attribute to better memorability.

Overall, the usability of the new method has been sufficiently described and tested with a fair amount of users (n=30). However, the manuscript overall lacks appropriate descriptions of key terminology and the motivation behind the study is not clearly explained. In order to improve replicability, clearer descriptions of the methods/procedures are necessary as well. Added to this, there are numerous small figures that could be combined, and the captions overall are rather uninformative. These main issues, along with minor suggestions/questions, are described in detail below.

Main:

The Introduction does not provide any specific reasoning as to why this topic is important and as to why the reader should read the article, other than that “there is an uptrend of publications”, which is not clear from the data in Figure 1 in the first place – rather, the number of publications in this area seems pretty stable over the last decade. Furthermore, an essential concept such as shoulder surfing is not explained. More background about the importance of visual passwords, shoulder-surfing, memorability, etc. would be informative to the general reader.
The lack of clarification continues in the Literature Review, e.g., the “automatic sliding variant” or “intersection attacks” are mentioned as if the reader should know about this already. A proper explanation and research background on these issues would improve the manuscript considerably. Related to this, based on the literature, the authors chose “DragPIN” as the reference method and listed 4 references of related works (Table 1). A quick literature scan (Google Scholar) on graphical password and emojis, however, yielded at least 20 seemingly relevant references. Again, a more elaborate description of the research background on the use of emojis as graphical passwords would provide a more solid ground for the current study. The article has just 14 references (however, see minor point 9 below), and 5 are self-referenced to the dataset.
The manuscript contains 17 figures and 4 tables. Many of the figures (e.g., Figs 3 and 4, and Figs 4 and 5) can be combined or seem unnecessary (e.g., Figure 8 just shows a sign-in bar). Moreover, the captions are not informative at all. Ideally, one should be able to understand a paper by just checking the figures and reading the captions, without the main text. For example, the caption of Figure 6 is “Flow diagram”, that of Figure 7 is “Cue question registration”. Why not provide full descriptions that include names of methods, etc., as a service to the reader.

Minor:

Abstract, Line 15, “Moreover … observers”. The sentence suggest that this was tested. If so, it should be moved under “Results”.
There are some unclear/inconsistent terms in the abstract, which make it difficult to grasp in one read:
- Line 18-21 “modified versions” L18, unclear here.
- Results. “All implementations...shoulder surfing”. Maybe a line on how this was tested?
- Conclusion, “..PIN-based” means “numeric”?
Introduction, line 6: explain “dimensions.ai”? If this is a reference or URL, please provide.
Literature review, P3, L5: The statement that “DragPIN ... uses numbers, which are less memorable than pictures” is debatable, since highly personalized numerical PINs (e.g., date/year of birth) are often chosen specifically because they are easy to remember.
Literature review, P3, L7: “Both methods” meaning exactly which methods? Help the reader with clear descriptions.
Figure 1. Other than suggested in the Introduction, I do not see a clear uptrend of publications in the last decade or so. Also, please explain whether these numbers include papers related to shoulder surfing or not. Furthermore, Y-axis: what does 9K mean in relation to 75, 50, 25?
Figure 5. Why and how were these emojis selected?
Page 5, para 4, “Resistance to SSA is increased by having randomly chosen cue questions”. Unclear. For the sake of replicability, were these dummy questions or selected from the user database? Were they presented on the screen along with the "correct" cue question for each user?
User test study, P7: both references not numbered and not in the reference list.
P8, Phase 1, line 7: “Four shoulder surfers...attempting SSA”. For the sake of replicability, did all 4 perform SSA on each single user? Were they standing behind a user, at what given distance? Please provide details.
P8, System usability survey. Likert scale questions – what was the scale range and what were the end points?
P9, Figure 12: Y-axis (Frequency) shows the number of participants, while all other figures show percentages. X-axis: “Bin” is uninformative. I assume “0” means weak and “5” means strong, but please provide exact information on the axis label. What is “more” on the x-axis?
P11, Figure 16. X-axis. Unnecessary “0”s behind period of each value (100.0%, etc.)
P11. Login time and login attempts were recorded, but what was the average number of emojis used in the passwords? Users could use in between 6-10 emojis and a higher number likely results in a longer login time and more login mistakes. Please provide information.
P11, Significance testing. I don’t see any specific justification for using a one-tailed test for hypotheses 3. and 4. DragPIN (reference 6) apparently has been tested and used before, so there is no reason to think by default that it can only render more failures than EmojiSlide. Two-tailed seems appropriate.
P11, second sentence from bottom: “This suggests higher memorability in the proposed method.” Login failures indeed could be due to poor memorability of a password, but is it possible that they also could have been due to differences in system navigation (e.g., button press misses, or swiping mistakes) between both methods?

Is the work clearly and accurately presented and does it cite the current literature?

Partly
Is the study design appropriate and is the work technically sound?

Partly
Are sufficient details of methods and analysis provided to allow replication by others?

Partly
If applicable, is the statistical analysis and its interpretation appropriate?

Partly
Are all the source data underlying the results available to ensure full reproducibility?

Yes
Are the conclusions drawn adequately supported by the results?

Partly

Competing Interests: No competing interests were disclosed.

Reviewer Expertise: perceptual psychology

I confirm that I have read this submission and believe that I have an appropriate level of expertise to confirm that it is of an acceptable scientific standard, however I have significant reservations, as outlined above.

CITE

Report a concern

Author Response 28 Apr 2022

Yvonne Kam, MMU Cyberjaya, Cyberjaya, Malaysia

28 Apr 2022

Author Response
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,
1. We will provide more reasons and motivations for this
... Continue reading
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,

We will provide more reasons and motivations for this work and explain the concept of shoulder surfing.

We will clarify the terms and add more references.

The number of figures and content will be reviewed and the captions made more clear.

We will also address the minor comments.

We will revise the manuscript after receiving the 2nd reviewer report. We will endeavor to clarify concepts and give more details to facilitate the reader's understanding in the coming revision.
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,

We will provide more reasons and motivations for this work and explain the concept of shoulder surfing.

We will clarify the terms and add more references.

The number of figures and content will be reviewed and the captions made more clear.

We will also address the minor comments.

We will revise the manuscript after receiving the 2nd reviewer report. We will endeavor to clarify concepts and give more details to facilitate the reader's understanding in the coming revision.
Competing Interests: No competing interests were disclosed. Close
Report a concern
Respond or Comment

COMMENTS ON THIS REPORT

Author Response 28 Apr 2022

Yvonne Kam, MMU Cyberjaya, Cyberjaya, Malaysia

28 Apr 2022

Author Response
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,
1. We will provide more reasons and motivations for this
... Continue reading
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,

We will provide more reasons and motivations for this work and explain the concept of shoulder surfing.

We will clarify the terms and add more references.

The number of figures and content will be reviewed and the captions made more clear.

We will also address the minor comments.

We will revise the manuscript after receiving the 2nd reviewer report. We will endeavor to clarify concepts and give more details to facilitate the reader's understanding in the coming revision.
Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,

We will provide more reasons and motivations for this work and explain the concept of shoulder surfing.

We will clarify the terms and add more references.

The number of figures and content will be reviewed and the captions made more clear.

We will also address the minor comments.

We will revise the manuscript after receiving the 2nd reviewer report. We will endeavor to clarify concepts and give more details to facilitate the reader's understanding in the coming revision.
Competing Interests: No competing interests were disclosed. Close
Report a concern

Comments on this article Comments (0)

Version 1

VERSION 1 PUBLISHED 29 Mar 2022

Open Peer Review

Reviewer Status

Reviewer Reports

	Invited Reviewers
	1	2
Version 1 29 Mar 22	read	read

Gerard Bastiaan Remijn, Kyushu University, Fukuoka, Japan
Nur Haryani Zakaria, Universiti Utara Malaysia, Kedah, Malaysia

Comments on this article

All Comments(0)

Add a comment

Browse by related subjects

Back to all reports

Reviewer Report

6 Views

02 Feb 2023 | for Version 1

Nur Haryani Zakaria, School of Computing, Universiti Utara Malaysia, Kedah, Malaysia

6 Views Cite this report Responses(0)

Not Approved

Is the work clearly and accurately presented and does it cite the current literature?

Partly
Is the study design appropriate and is the work technically sound?

Partly
Are sufficient details of methods and analysis provided to allow replication by others?

Partly
If applicable, is the statistical analysis and its interpretation appropriate?

Partly
Are all the source data underlying the results available to ensure full reproducibility?

No
Are the conclusions drawn adequately supported by the results?

No

Competing Interests

No competing interests were disclosed.

Reviewer Expertise

Information security

Respond to this report

Responses (0)

Back to all reports

Reviewer Report

12 Views

13 Apr 2022 | for Version 1

Gerard Bastiaan Remijn, Faculty of Design, Department of Human Science, Kyushu University, Fukuoka, Japan

12 Views Cite this report Responses(1)

Approved With Reservations

The Introduction does not provide any specific reasoning as to why this topic is important and as to why the reader should read the article, other than that “there is an uptrend of publications”, which is not clear from the data in Figure 1 in the first place – rather, the number of publications in this area seems pretty stable over the last decade. Furthermore, an essential concept such as shoulder surfing is not explained. More background about the importance of visual passwords, shoulder-surfing, memorability, etc. would be informative to the general reader.
The lack of clarification continues in the Literature Review, e.g., the “automatic sliding variant” or “intersection attacks” are mentioned as if the reader should know about this already. A proper explanation and research background on these issues would improve the manuscript considerably. Related to this, based on the literature, the authors chose “DragPIN” as the reference method and listed 4 references of related works (Table 1). A quick literature scan (Google Scholar) on graphical password and emojis, however, yielded at least 20 seemingly relevant references. Again, a more elaborate description of the research background on the use of emojis as graphical passwords would provide a more solid ground for the current study. The article has just 14 references (however, see minor point 9 below), and 5 are self-referenced to the dataset.
The manuscript contains 17 figures and 4 tables. Many of the figures (e.g., Figs 3 and 4, and Figs 4 and 5) can be combined or seem unnecessary (e.g., Figure 8 just shows a sign-in bar). Moreover, the captions are not informative at all. Ideally, one should be able to understand a paper by just checking the figures and reading the captions, without the main text. For example, the caption of Figure 6 is “Flow diagram”, that of Figure 7 is “Cue question registration”. Why not provide full descriptions that include names of methods, etc., as a service to the reader.

Minor:

Abstract, Line 15, “Moreover … observers”. The sentence suggest that this was tested. If so, it should be moved under “Results”.
There are some unclear/inconsistent terms in the abstract, which make it difficult to grasp in one read:
- Line 18-21 “modified versions” L18, unclear here.
- Results. “All implementations...shoulder surfing”. Maybe a line on how this was tested?
- Conclusion, “..PIN-based” means “numeric”?
Introduction, line 6: explain “dimensions.ai”? If this is a reference or URL, please provide.
Literature review, P3, L5: The statement that “DragPIN ... uses numbers, which are less memorable than pictures” is debatable, since highly personalized numerical PINs (e.g., date/year of birth) are often chosen specifically because they are easy to remember.
Literature review, P3, L7: “Both methods” meaning exactly which methods? Help the reader with clear descriptions.
Figure 1. Other than suggested in the Introduction, I do not see a clear uptrend of publications in the last decade or so. Also, please explain whether these numbers include papers related to shoulder surfing or not. Furthermore, Y-axis: what does 9K mean in relation to 75, 50, 25?
Figure 5. Why and how were these emojis selected?
Page 5, para 4, “Resistance to SSA is increased by having randomly chosen cue questions”. Unclear. For the sake of replicability, were these dummy questions or selected from the user database? Were they presented on the screen along with the "correct" cue question for each user?
User test study, P7: both references not numbered and not in the reference list.
P8, Phase 1, line 7: “Four shoulder surfers...attempting SSA”. For the sake of replicability, did all 4 perform SSA on each single user? Were they standing behind a user, at what given distance? Please provide details.
P8, System usability survey. Likert scale questions – what was the scale range and what were the end points?
P9, Figure 12: Y-axis (Frequency) shows the number of participants, while all other figures show percentages. X-axis: “Bin” is uninformative. I assume “0” means weak and “5” means strong, but please provide exact information on the axis label. What is “more” on the x-axis?
P11, Figure 16. X-axis. Unnecessary “0”s behind period of each value (100.0%, etc.)
P11. Login time and login attempts were recorded, but what was the average number of emojis used in the passwords? Users could use in between 6-10 emojis and a higher number likely results in a longer login time and more login mistakes. Please provide information.
P11, Significance testing. I don’t see any specific justification for using a one-tailed test for hypotheses 3. and 4. DragPIN (reference 6) apparently has been tested and used before, so there is no reason to think by default that it can only render more failures than EmojiSlide. Two-tailed seems appropriate.
P11, second sentence from bottom: “This suggests higher memorability in the proposed method.” Login failures indeed could be due to poor memorability of a password, but is it possible that they also could have been due to differences in system navigation (e.g., button press misses, or swiping mistakes) between both methods?

Is the work clearly and accurately presented and does it cite the current literature?

Partly
Is the study design appropriate and is the work technically sound?

Partly
Are sufficient details of methods and analysis provided to allow replication by others?

Partly
If applicable, is the statistical analysis and its interpretation appropriate?

Partly
Are all the source data underlying the results available to ensure full reproducibility?

Yes
Are the conclusions drawn adequately supported by the results?

Partly

Competing Interests

No competing interests were disclosed.

Reviewer Expertise

perceptual psychology

Respond to this report

Responses (1)

Author Response

28 Apr 2022

Yvonne Kam, MMU Cyberjaya, Cyberjaya, Malaysia

Thank you to the reviewer for the detailed, insightful comments.

Regarding the major points raised by reviewer #1,

We will provide more reasons and motivations for this work and explain the concept of shoulder surfing.
We will clarify the terms and add more references.
The number of figures and content will be reviewed and the captions made more clear.

We will also address the minor comments.

We will revise the manuscript after receiving the 2nd reviewer report. We will endeavor to clarify concepts and give more details to facilitate the reader's understanding in the coming revision.

View more View less

Competing Interests

No competing interests were disclosed.

Alongside their report, reviewers assign a status to the article:

Approved - the paper is scientifically sound in its current form and only minor, if any, improvements are suggested

Approved with reservations - A number of small changes, sometimes more significant revisions are required to address specific details and improve the papers academic merit.

Not approved - fundamental flaws in the paper seriously undermine the findings and conclusions

[1] 1. Paivio A, Csapo K: Picture superiority in free recall: Imagery or dual coding?. Cogn. Psychol. 1973 Sep.; 5(2): 176–206. Publisher Full Text

[2] 2. Biddle R, Chiasson S, Van Oorschot PC: Graphical passwords: Learning from the first twelve years. ACM Comput. Surv. September 2013; 44(4). ISSN 0360-0300. Publisher Full Text

[3] 3. Snodgrass JG, Asiaghi A: The pictorial superiority effect in recognition memory. Bull. Psychon. Soc. 1977 Jul.; 10(1): 1–4. Publisher Full Text

[4] 4. Emoji authentication In publications—Dimensions: n.d. Retrieved September 1, 2021. Reference Source

[5] 5. Golla M, Detering D, Drmut M: Emojiauth: quantifying the security of emoji-based authentication.2017. Publisher Full Text

[6] 6. Srinivasan R: DragPIN: A secured PIN entry scheme to avert attacks. Int. Arab J. Inf. Technol. 2018.

[7] 7. Salman M, Li Y, Wang J: A graphical pin entry system with shoulder surfing resistance. 2019 IEEE 4th International Conference on Signal and Image Processing (ICSIP). 2019. Publisher Full Text

[8] 8. Kasat OK, Bhadade U: Revolving flywheel pin entry method to prevent shoulder surfing attacks. 2018 3rd International Conference for Convergence in Technology (I2CT). 2018. Publisher Full Text

[9] 9. Amer M: mahrous-amer/FYP: EmojiSlide-Prototype (v0.1-beta). Zenodo. 2021. Publisher Full Text

[10] 10. Bangor A, Kortum P, Miller J: Determining what individual SUS scores mean: Adding an adjective rating scale. J. Usability Stud. 2009; 4(3): 114–123.

[11] 11. Amer M: Pre-survey.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text

[12] 12. Amer M: Phase1&2.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text

[13] 13. Amer M: SUS.csvUsing Emojis in a Shoulder-surfing Resistant Authentication Method. figshare. Dataset. 2021. Publisher Full Text

[14] 14. Amer MM, Kam YH, Goh VT: A Study on Using Emojis in a Shoulder Surfing Resistant Authentication Method. Lecture Notes in Electrical Engineering 2021.

Improving memorability using Emojis in a shoulder surfing resistant authentication method

Abstract

Keywords

Introduction

Figure 1. Trend of picture/emoji-based authentication.4

Literature review

Table 1. Comparison of related works.

Methods

DragPIN and EmojiAuth

Figure 2. DragPIN prototype signup page.

Figure 3. DragPIN implementation.

Figure 4. EmojiAuth prototype sign in.

Figure 5. Emoji Keyboard.

Proposed method – EmojiSlide

Figure 6. Flow diagram.

Figure 7. Cue question registration.

Figure 8. Sign-in page of the proposed method.

Figure 9. Sign-in page with a Cross Site Request Forgery (CSRF) token.

Figure 10. Proposed manual implementation.

Figure 11. Proposed automatic implementation.

User test study

Presurvey

Box 1. Pre-survey questions.

Box 2. Post-survey questions.

Box 3. System usability survey.

Results and discussion

Presurvey

Figure 12. Initial feedback on emoji password acceptance.

Figure 13. Initial feedback on the memorability of Emojis.

User testing of EmojiSlide

Figure 14. Participants age groups.

Table 2. Participant demographics of the user testing study.

Table 3. Time taken for login.

Figure 15. Users’ perception of the proposed method’s ability to resist SSA.

Figure 16. Phase 1 and phase 2 average success rate (including intermediate failures).

Significance testing

Table 4. Sets of hypotheses.

System usability survey

Figure 17. System usability testing results.

Limitations and future improvement

Conclusion

Data availability

Underlying data

Software availability

Grant information

Acknowledgments

References

Comments on this article Comments (0)

Open Peer Review

Comments on this article Comments (0)

Open Peer Review

Reviewer Status

Reviewer Reports

Comments on this article

Browse by related subjects

Competing Interests Policy

Stay Updated

Figure 1. Trend of picture/emoji-based authentication.⁴