![](bg8.png)
and in generating the image-based formulation of the
questions in the current study.
5 SUMMARY AND FUTURE
WORK
In this paper we presented a study that is part of a
wider investigation into the appropriateness of
electronic personal history information for
authentication purposes. The study used academic
personal web site data as a source of personal history
information. The main aim of the study was to
examine the effect of using an image-based
formulation of questions about personal history
events. In contrast, to most other work in this area,
the study followed a methodology that assesses the
impact on both genuine users and attackers (others
close to the genuine users). The study concluded that
an image-based representation of questions is
certainly beneficial from an authentication point of
view. It also concluded that a small increase in the
number of distracters used in closed questions has a
positive effect to authentication performance. In
addition to this, the study also showed that despite
the closeness of the attackers their ability to answer
correctly with high confidence questions about the
genuine users’ personal history is limited. These
conclusions contribute positive results to the wider
investigation into the appropriateness of electronic
personal history information for authentication
purposed.
Besides the points identified above, moving this
investigation forward requires that we adopt a wider
perspective. So far, our investigation has exclusively
focused on the performance of genuine users and
attackers in answering correctly the generated
questions. As the results in this front are
encouraging, it is now time to consider additional
aspects that determine the appropriateness of the
approach for authentication. The main issue is to
determine to what extent and in which contexts such
an authentication mechanism would be acceptable to
users. User acceptance relies primarily on two
aspects. How effective and efficient the mechanism
is to use, and whether this use of personal data is
acceptable to users. In doing so, we need to study
the mechanism in specific contexts, e.g. for
authentication to online services, or authentication to
users’ personal mobile devices, etc.
In conclusion, authentication via electronic
personal history questions seems very promising in
comparison to other usable authentication schemes.
Our initial studies show some encouraging results
for its feasibility; however further research is
necessary before a concrete authentication
mechanism can be produced.
REFERENCES
Brostoff, A., Improving password system effectiveness
Department of Computer Science, University College
London UCL, Doctor of Philosophy Thesis, 2004.
Davis, D., Monrose, F. and Reiter, K., On User Choice in
Graphical Password Schemes. In Proc 13th USENIX
Security Symposium,(2004), 151-164.
De-Angeli, A., Coutts, M., Coventry, L., Johnson, G.,
Cameron, D. and Fischer, M., VIP: A Visual
Approach to User Authentication. In Proc Advanced
Visual Interfaces AVI, ACM Press, (2002), 316-323.
Dhamija, R., Hash Visualization in User Authentication.
In Proc. (CHI), ACM Press, (2000), 279 – 280.
Harper, R., Rodden, T., Rogers, Y. and Sellen, A., (Eds.),
Being Human: Human-Computer Interaction in the
year 2020. Cambridge, Microsoft Research Ltd., 2008.
Just, M., Designing and Evaluating Challenge Question
Systems." In Proc IEEE Security & Privacy: Special
Issue on Security and Usability, 2,(5), (2004), 32- 39.
Passface, Real-User Passfaces™,
http://www.passfaces.com.
Pering, T., Sundar, M., Light, J. and Want, R.,
Photographic Authentication through Untrusted
Terminals, Security & Privacy, 2, (1), (2003),30-36.
Nosseir, A., Connor, R. and Dunlop, M., Internet
Authentication Based on Personal History – A
Feasibility Test, Workshop on Customer Focused
Mobile Services at WWW 2005, (2005).
Nosseir, A., Connor, R., Revie, C. and Terzis, S.,
Question-Based Authentication Using Context Data,
ACM Nordic Conference on Human Computer
Interaction (NordiCHI 2006), Oslo, Norway, (2006).
Takada, T and Koike, H., Awase-E: Image-based
Authentication for Mobile Phones Using User’s
Favourite Images, Human-Computer Interaction with
Mobile Devices and Services, 2795, (2003). 347-351.
Wiedenbeck, S., Waters, J., Birget, J.C., Brodskiy, A. and
Memon, N., Authentication Using Graphical
Passwords: Effects of Tolerance and Image Choice. In
Proc. Symposium on Usable Privacy and Security
(SOUPS), ACM Press, (2005), 1-12.
Yan, J., Blackwell, A., Anderson, R. and Grant, A.,
Password Memorability and Security: Empirical
Results, IEEE Security & Privacy, 5,(2), (2004), 25-
31.
Zviran, M. and Haga, W., Cognitive Passwords: the Key
to Easy Access Control, Computers and Security, 9,
(1990),723-736.
Zviran, M. and Haga, W., A Comparison of Password
Techniques for Multilevel Authentication
Mechanisms, The Computer Journal, 36,(3), (1993),
227-237.
ICEIS 2010 - 12th International Conference on Enterprise Information Systems
70