The main aim of this project is an integrated evaluation of the Captcha as Graphical Passwords scheme
(CaRP) is both a Captcha and a
graphical password scheme., including usability and security
evaluations, and implementation considerations. An important usability goal for
knowledge-based authentication systems is to support users in selecting passwords
of higher security, in the sense of being from an expanded effective security
space. We use persuasion to influence user choice in click-based graphical
passwords, encouraging users to select more random, and hence more difficult to
Using hard AI (Artificial Intelligence) problems for security,
Under this paradigm, the most notable primitive invented is Captcha, which
distinguishes human users from computers by presenting a challenge, i.e., a
puzzle, beyond the capability of computers but easy for humans. Captcha is now
a standard Internet security technique to protect online email and other
services from being abused by bots.
we introduce a new security primitive based on hard AI problems,
namely, a novel family of graphical password systems integrating Captcha
technology, which we call CaRP (Captcha as graphical Passwords). CaRP is
click-based graphical passwords, where a sequence of clicks on an image is used
to derive a password. Unlike other click-based graphical passwords, images used
in CaRP are Captcha challenges, and a new CaRP image is generated for every
login attempt. The notion of CaRP is simple but generic. CaRP can have multiple
instantiations. In theory, any Captcha scheme relying on multiple-object
classification can be converted to a CaRP scheme. We present exemplary CaRPs
built on both text Captcha and image-recognition Captcha. One of them is a text
CaRP wherein a password is a sequence of characters like a text password, but
entered by clicking the right character sequence on CaRP images.
A large number of graphical password schemes have been proposed.
They can be classified into three categories according to the task involved in
memorizing and entering passwords.
A recognition-based scheme
requires identifying among decoys the visual objects belonging to a password
portfolio. A typical scheme is Passfaces wherein
a user selects a portfolio of faces from a database in creating a password. During authentication, a panel of
candidate faces is presented for the user to select the face belonging to her
portfolio. This process is repeated several rounds, each round with a different panel. A successful login requires
correct selection in each round. The set of images in a panel remains the same
between logins, but their locations are permuted. Cognitive Authentication requires
a user to generate a path through a panel of images as follows: starting from
the top-left image, moving down if the image is in portfolio, or right
otherwise. The user identifies among
decoys the row or column label that the path ends. This process is repeated,
each time with a different panel. A successful login requires that the
cumulative probability that correct answers were not entered by chance exceeds
a threshold within a given number of rounds.
A recall-based scheme
requires a user to regenerate the same interaction result without cueing.
Draw-A-Secret (DAS) was the first
recall-based scheme proposed. A user draws password on a 2D grid. The system
encodes the sequence of grid cells along the drawing path as a user drawn password.
Pass-Go improves DAS’s usability by encoding the grid intersection points
rather than the grid cells. BDAS adds
background images to DAS to encourage users to create more complex passwords.
Typical application scenarios for CaRP
CaRP can be applied on touch-screen devices whereon typing passwords is
cumbersome, esp. for secure Internet applications such as e-banks. Many
e-banking systems have applied Captchas in user logins.
CaRP increases spammer’s operating cost and thus helps reduce spam emails. For
an email service provider that deploys CaRP, a spam bot cannot log into an email
account even if it knows the password. Instead, human involvement is compulsory
to access an account. If CaRP is combined with a policy to throttle the number of
emails sent to new recipients per login session, a spam bot can send only a
limited number of emails before asking human assistance for login, leading to
reduced outbound spam traffic.
In a cued-recall scheme,
an external cue is provided to help memorize and enter
a password. PassPoints is a widely studied click-based cued-recall
scheme wherein a user clicks a sequence of points anywhere on an image in
creating a password, and re-clicks the same sequence during authentication.
Cued Click Points (CCP) is similar to PassPoints but uses one image per click, with the
next image selected by a deterministic function. Persuasive Cued Click Points (PCCP) extends CCP by requiring a user to
select a point inside a randomly positioned
viewport when creating a password, resulting in more randomly distributed
click-points in a password.
Captcha relies on the gap of capabilities between humans and bots in solving certain hard AI
problems. There are two types
of visual Captcha:
ü Text Captcha
ü Image-Recognition Captcha (IRC).
1.2.1 Text Captcha
The former relies on character recognition while the latter relies on recognition
of non-character objects.
Security of text Captchas has been extensively studied. The following principle has been established: Text Captcha should rely on the difficulty
of character segmentation, which
is computationally expensive and combinatorial
Machine recognition of non-character objects is
far less capable than character recognition. IRCs rely on
the difficulty of object identification or classification,
possibly combined with the difficulty of object segmentation.
Asirra relies on binary object classification: a user is asked to identify all the cats from a panel of 12 images of cats and dogs.
Security of IRCs has also been studied. Asirra was found to
be susceptible to machine-learning attacks. IRCs based on binary object classification or identification of one concrete
type of objects are likely insecure. Multi-label classification problems are considered much harder than binary classification problems.