User-Generated Free-Form Gestures for Authentication: Security and Memorability
Michael Sherman, Gradeigh Clark, Yulong Yang, Shridatt Sugrim, Arttu, Modig, Janne Lindqvist, Antti Oulasvirta, Teemu Roos

TL;DR
This study evaluates the security and memorability of free-form multitouch gestures for mobile authentication, introducing a new metric for security analysis and testing practical recognition and resistance to shoulder surfing.
Contribution
It introduces a novel information capacity metric for free-form gestures and provides empirical data on their security and memorability in authentication.
Findings
One-finger gestures had higher mutual information than multi-finger gestures.
Gestures with many angles and turns had the highest information capacity.
Signatures and simple angular shapes were most memorable.
Abstract
This paper studies the security and memorability of free-form multitouch gestures for mobile authentication. Towards this end, we collected a dataset with a generate-test-retest paradigm where participants (N=63) generated free-form gestures, repeated them, and were later retested for memory. Half of the participants decided to generate one-finger gestures, and the other half generated multi-finger gestures. Although there has been recent work on template-based gestures, there are yet no metrics to analyze security of either template or free-form gestures. For example, entropy-based metrics used for text-based passwords are not suitable for capturing the security and memorability of free-form gestures. Hence, we modify a recently proposed metric for analyzing information capacity of continuous full-body movements for this purpose. Our metric computed estimated mutual information in…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsUser Authentication and Security Systems · Digital Communication and Language · Advanced Malware Detection Techniques
