2014/08/12 by Mahdi Nasrullah Al-Ameen, Matthew Wright, Al-Ameen, Mahdi Nasrullah +1 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Biometric Identification and Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Human-Computer Interaction (cs.HC) #K.6.5 #User Authentication and Security Systems #cs.CR #cs.HC
paper · pdf · doi:10.48550/arxiv.1408.2852
14 pages, 5 figures, 10 tables
arxiv created 2014/08/12 · openalex publication_date 2014/08/12 · arxiv updated 2014/08/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Before deploying a new user authentication scheme, it is critical to subject the scheme to comprehensive study. Few works, however, have undertaken such a study. Recently, Thorpe et al. proposed GeoPass, the most promising of a class of user authentication schemes based on geographic locations in online maps. Their study showed very high memorability (97%) and satisfactory resilience against online guessing, which means that GeoPass has compelling features for real-world use. No comprehensive study, however, has been conducted for GeoPass or any other location-based password scheme. In this paper, we present a systematic approach for the detailed evaluation of a password system, which we implement to study GeoPass. We conducted three separate studies to evaluate the suitability of GeoPass for widespread use. First, we performed a field study over two months, in which users in a real-world setting remembered their location-passwords 96% of the time and showed improvement with more login sessions. Second, we conducted a study to test how users would fare with multiple location-passwords and found that users remembered their location-passwords in less than 70% of login sessions, with 40% of login failures due to interference effects. Third, we conducted a study to examine the resilience of GeoPass against shoulder surfing. Our participants played the role of attackers and had an overall success rate of 48%. Based on our results, we suggest suitable applications of GeoPass in its current state and identify aspects of GeoPass that must be improved before widespread deployment could be considered.