Search

One of the methods touted to reduce shoulder surfing during onscreen authentication is eye gaze input. Eye gaze authentication methods have thus far relied on a few methods for selection of on screen objects, namely dwell time, blinking, eye gestures and pursuit of moving objects. This paper surveys the literature on the various approaches. From analysis of the advantages and drawbacks of the surveyed approaches, we find that the dwell method has advantages in security and usability. We then describe a method designed previously by the authors that enhances the dwell method by making use of peripheral vision. The proposed method is in the ideation stage.

Standard authentication methods require user to remember long texts or random numbers when authenticating. The elderly face problems of remembering these passwords maybe due to cognitive decline or simply because they are unfamiliar with current technological devices. This paper compares available authentication methods that are more usable for the elderly and summarises the effectiveness of these systems

Authentication systems used in the security world vary greatly but one system, the textual password authentication system, has dominated and become the most common authentication method used today. However, secure textual passwords are difficult to remember. In contrast, faces are easier to remember than text [1]. In this study, a face-based graphical authentication system that utilizes hybrid images has been developed. To the best of the authors’ knowledge, hybrid images of faces has not yet been used for authentication, thus this study uses optical illusion on faces for the purpose of authentication. The main purpose of the method is to reduce the limitations found in conventional text (or PIN) based authentication methods, i.e. passwords are difficult to remember and vulnerability to shoulder surfing attacks. The system was tested on 20 users who logged in while being shoulder surfed. The results showed that shoulder surfing attacks were successfully prevented. With only one attempt, 35% of the users logged in correctly. They had a 72% accuracy in identifying the pass faces. In contrast, none of the shoulder surfers managed to login despite being given three attempts. They guessed correctly only 17% of the user’s pass images.

While images or emojis offer good memorability when used in an authentication method, inherently graphical data are highly susceptible to shoulder surfing attacks. An authentication system incorporating emojis was proposed and designed, which offers resistance to shoulder surfing attacks. The proposed system implements emojis in place of numerics in the reference method, DragPIN, and adds cue questions. The methods are compared in terms of performance and memorability, through user testing. The proposed authentication system was found to be successful at resisting shoulder surfing attacks. After 4–6 weeks, memorability was also higher in the proposed method compared to the reference method.

In this paper, we show several vulnerabilities in the ordering mechanism of one of Malaysia’s online food ordering services company (which we will call “Company X”) website. In particular, we show that the system is open to several kinds of abuse, demonstrating two proof-of-concept attacks we carried out, as well as discuss more potentially disruptive theoretical attacks. We also suggest several countermeasures to rectify the issues, that are not only applicable to Company X website, but also to other similar online ordering systems.

Searchable encryption is a cryptographic primitive that allows a user to confidentially store items on an outside server and grants the user the capability to search for any particular item that is stored without the server or any third party observers learning anything with regards to the item that is being searched for. In 2006, Curtmola et al. strengthened the security notions for symmetric-key searchable encyrption (SSE) and proposed two secure constructions that utilize only a conventional symmetric-key encryption scheme such as Advanced Encryption Standard (AES). In this work, we show a client-server prototype implementation of the adaptive-secure scheme by Curtmola et al. utilizing only open source software on both client and server side. We show that our implementation runs in reasonable time and provides confidential search functions as defined by SSE schemes.

Traditionally, picture-based password systems employ password objects (pictures/icons/symbols) as input during an authentication session, thus making them vulnerable to “shoulder-surfing” attack because the visual interface by function is easily observed by others. Recent software-based approaches attempt to minimize this threat by requiring users to enter their passwords indirectly by performing certain mental tasks to derive the indirect password, thus concealing the user’s actual password. However, weaknesses in the positioning of distracter and password objects introduce usability and security issues. In this paper, a new method, which conceals information about the password objects as much as possible, is proposed. Besides concealing the password objects and the number of password objects, the proposed method allows both password and distracter objects to be used as the challenge set’s input. The correctly entered password appears to be random and can only be derived with the knowledge of the full set of password objects. Therefore, it would be difficult for a shoulder-surfing adversary to identify the user’s actual password. Simulation results indicate that the correct input object and its location are random for each challenge set, thus preventing frequency of occurrence analysis attack. User study results show that the proposed method is able to prevent shoulder-surfing attack.

Currently, distance education (DE) courses in Malaysia are only for the non-scientific field since DE lacks the laboratory experimentation indispensable to science. The concept of Virtual laboratory provides a timely solution. This paper describes the development and implementation of a novel, multimedia interactive laboratory (MI-LAB) for online experimentation. The aim of the MI-LAB project is to provide students access via the Internet to various experiments in conceptual physics, simplifying experimentation for home-learners and professionals in a distance teaching environment. MI-LAB's effectiveness is thoroughly demonstrated in the development of the Hall Effect experiment lab aimed at enhancing student's understanding. MI-LAB supplements the physical lab by augmenting student's learning experiences with relevant information, questions, graphs and video demonstrations. This Web approach integrates Flash actionscript to do extensive simulations and interactive animation of physics based experiments in virtual reality. MI-LAB is a low cost, zero maintenance, and risk-free alternative to conventional lab for DE.