Comparison Between PIN and Picture-Based Implementations in Gaze-Based Authentication

Legacy passwords (e.g., PINs, text or graphical passwords) which are compatible with existing server backends, are textual or image based. The type of password may have bearing on the memorability of the password. It has been proven that pictures are more memorable than text, but will the maxim still hold when the pictures in the challenge set have high visual similarity to one another? We consider pictures in comparison to the alternative of the highly familiar Personal Identification Number (PIN). Both these types of password were implemented and tested on a gaze-based authentication platform. Gaze-based systems already reduce the tendency of leakage of information during login and thus it is in this context we consider the need for usability over resistance to shoulder surfing. Two login systems were developed which is the normal PIN number and picture-based password. 27 people participated in the user testing and survey. In both systems, users had 100% login success rate within the three attempts given, and the participants perceived the gaze-based authentication systems positively. However, for the picture-based password, where the pictures in the challenge set had high visual similarity to one another, 33.3% took two attempts while one attempt was sufficient in PIN password for all participants. The time taken was also longer than with the PIN. Feedback also showed that the participants were less positive about the pictures’ memorability. The results show that PINs may be more usable than pictures when the pictures have similar semantic meaning and visual similarity with the pass images. These considerations may inform the design of passwords in gaze-based authentication