Current technology is more than capable of providing a secure authentication process, but users are limited in their ability to remember difficult passwords or make judgments about security. In this thesis, both of these problems were tackled in the design of a new picture-password system. Studies in computer security, password usability, and cognitive psychology were referenced throughout the design process.
The new system was tested against character passwords of equal complexity and recall was measured over an eight-day period. The results of the study show that a picture password system which accepts input without respect to order can be both secure and memorable. Picture passwords were randomly assigned from a password space of almost 29 billion (2.899 × 10 10) and were remembered by all fifteen of the picture-group participants eight days later, whereas character passwords were not universally remembered.
In addition, the study found that a substantial number of failed inputs by users are repeats of previous inputs in the same session. This reduces the number of distinct guesses users can make when authentication systems limit the number of allowed failed logins (known as account lockout). A protocol was developed to ignore these duplicate inputs in a way which incurs almost no security risk and improves usability.