We address the problem of shoulder-surfing attacks on authentication schemes by proposing IllusionPIN (IPIN), a PIN-based authentication method that operates on touchscreen devices. IPIN uses the technique of hybrid images to blend two keypads with different digit orderings in such a way, that the user who is close to the device is seeing one keypad to enter her PIN, while the attacker who is looking at the device from a bigger distance is seeing only the other keypad. The user’s keypad is shuffled in every authentication attempt, since the attacker may memorize the spatial arrangement of the pressed digits. To reason about the security of IPIN, we developed an algorithm which is based on human visual perception and estimates the minimum distance from which an observer is unable to interpret the keypad of the user. We tested our estimations with 84 simulated shoulder-surfing attacks from 21 different people. None of the attacks was successful against our estimations. In addition, we estimated the minimum distance from which a camera is unable to capture the visual information from the keypad of the user. Based on our analysis, it seems practically almost impossible for a surveillance camera to capture the PIN of a smartphone user when IPIN is in use.
@cite_43: As a technique for authentication through untrusted public Internet terminals, photographic authentication relies on a person's ability to recognize personal photographs. The results from the authors' study demonstrate that this technique can reasonably withstand replay attacks, a common vulnerability of many existing techniques.
@cite_9: 
@cite_29: Current secure systems suffer because they neglect the importance of human factors in security. We address a fundamental weakness of knowledge-based authentication schemes, which is the human limitation to remember secure passwords. Our approach to improve the security of these systems relies on recognition-based, rather than recall-based authentication. We examine the requirements of a recognition-based authentication system and propose Deja Vu, which authenticates a user through her ability to recognize previously seen images. Deja Vu is more reliable and easier to use than traditional recall-based schemes, which require the user to precisely recall passwords or PINs. Furthermore, it has the advantage that it prevents users from choosing weak passwords and makes it difficult to write down or share passwords with others. We develop a prototype of Deja Vu and conduct a user study that compares it to traditional password and PIN authentication. Our user study shows that 90 of all participants succeeded in the authentication tests using Deja Vu while only about 70 succeeded using passwords and PINS. Our findings indicate that Deja Vu has potential applications, especially where text input is hard (e.g., PDAs or ATMs), or in situations where passwords are infrequently used (e.g., web site passwords).
The principle states that the required input has to change in every authentication attempt @cite_43 @cite_9 . For example, Deja Vu @cite_29 presents to the user a number @math of images, and asks her to specify which of them belong to a predefined set of images, called the user's portfolio. In each authentication attempt, different images from the portfolio are assigned to the set of the @math images. As a consequence, an observer cannot learn the portfolio of the user in a limited number of observations. However, multiple observations may reveal the whole portfolio. In general, with such schemes is difficult for the user to get familiar with a standard input. For example, with Deja Vu the user has to identify different pictures in every authentication attempt. This requires additional cognitive effort and may affect the authentication time and the error rate.