Researchers test whether squiggly lines will replace actual passwords

Life is digital these days and one of the most important parts of maintaining our privacy is ensuring we have a secure password on all of our digital accounts and electronic devices.

More recently we've even heard about a variety of security breaches that have forced many to change their passwords completely.

So what if we didn't use passwords at all anymore and instead verified ourselves with squiggly lines?

Researchers studied the practicality of using free-form gestures for access authentication
on smartphones and tablets. (Image via Rutgers University)

Researchers from Rutgers University School of Engineering have been exploring the security and memorability of free-form gestures and passwords. A new Rutgers study shows that free-form gestures, which include sweeping fingers in shapes across the screen of a smartphone or tablet, can be used to unlock phones and grant access to apps.

This is similar to those connect-the-dots password capabilities some devices offer, but the university claims that these free-form gestures are less likely to be observed and duplicated.

“All it takes to steal a password is a quick eye. With all the personal and transactional information we have on our phones today, improved mobile security is becoming increasingly critical,” said Janne Lindqvist, one of the leaders of the project and an assistant professor in the School of Engineering’s Department of Electrical and Computer Engineering. 

In trying to solve password security issues, Rutgers teamed up with the Max-Planck Institute for Informatics, Antti Oulasvirta and University of Helsinki and studied the practicality of using free-form gestures for access authentication.

Since you can create absolutely any shape you’d like, free-form gestures have a real shot at becoming functional, and since you don’t have to use a template to create them, they could offer greater complexity too.

“You can create any shape, using any number of fingers, and in any size or location on the screen,” said Lindqvist.

The test

Watch this video for further information on how this works.

In order to test this new method, researchers applied a generate-test-retest model where 63 participants were asked to create a gesture, recall it, and then recall it again 10 days later. The gestures were captured on a recognizer system designed by the team. Using this data, the researchers tested the importance of free-form gestures and, using information theory, invented a novel method to measure the complexity and accuracy of each gesture. Their analysis demonstrated results favorable to user-generated free-form gestures as passwords.

The Rutgers team then tested its safety on students. It had seven students attempt to steal a password by peering over another’s shoulder while they were active on their device. None of the students were able to accurately replicate the squiggly formation though.

For now, this method seems pretty secure in its preliminary stages and may one day eliminate passwords altogether in order to offer better protection for us. 

Story via Rutgers University.