Against Spyware Using CAPTCHA in Graphical Password Scheme

TL;DR

This paper introduces a CAPTCHA-based graphical password scheme designed to resist spyware attacks, enhancing security while maintaining usability, though further usability improvements are needed based on initial experiments.

Contribution

The paper proposes a novel CAPTCHA-based graphical password scheme that significantly increases resistance to spyware attacks compared to existing schemes.

Findings

The scheme raises the cost for adversaries by orders of magnitude.

Initial experiments suggest usability improvements are necessary.

The approach retains the advantages of graphical passwords while enhancing security.

Abstract

Text-based password schemes have inherent security and usability problems, leading to the development of graphical password schemes. However, most of these alternate schemes are vulnerable to spyware attacks. We propose a new scheme, using CAPTCHA (Completely Automated Public Turing tests to tell Computers and Humans Apart) that retaining the advantages of graphical password schemes, while simultaneously raising the cost of adversaries by orders of magnitude. Furthermore, some primary experiments are conducted and the results indicate that the usability should be improved in the future work.