Goa 2013 - Inception of graphical passwords

### Overview In this talk presented at Nullcon Goa 2013, Rishi introduces the concept and proof-of-concept implementation of graphical passwords for web applications, inspired by connect-the-dots games and touchscreen gestures. The motivation stems from the difficulty of typing complex, lengthy alphanumeric passwords on touch-enabled devices and the tendency of users to forget complex credentials. Rishi discusses how graphical pattern passwords can improve usability while mitigating conventional password guessing and simple network credential sniffing.

### Key Topics - **Issues with Conventional Passwords**: Alphanumeric passwords require remembering words and phrases, which makes complex passwords easy to forget or leads users to pick guessable passwords. Typing long credentials with special characters is especially tedious on mobile and touchscreen interfaces. - **Limitations of Existing Android Pattern Locks**: Traditional Android 3x3 pattern locks enforce strict constraints: users cannot lift their fingers, cannot draw disjoint parallel lines, cannot click the same dot repeatedly, and cannot connect fewer than a minimum threshold of dots. - **Connect-the-Dots Concept**: Rishi's approach allows lifting the finger, repeating clicks on the same node, drawing parallel segments, and freely scaling the grid (e.g., 3x3, 4x4, 6x6, or non-grid arbitrary dot distributions). - **Visual Feedback and Usability**: Using HTML5 Canvas or plain CSS, the interface provides visual feedback, such as color changes corresponding to the number of clicks on each dot. - **Obfuscation Against Man-in-the-Middle (MITM)**: By dynamically generating random session-specific keys on the server and binding them to each grid point, sniffers looking strictly for static password parameters fail to capture reusable credentials unless the complete initial session payload is intercepted.

### Technical Details - **Grid Representation and Sessions**: During registration, dot positions (e.g., coordinates numbered 11 through 22 in a grid) are recorded as the pattern sequence. At authentication time, the server generates unique random numbers for each dot (ensuring no duplicates) and stores them temporarily in a `session_tab` database table. These numbers are passed to the client JavaScript. - **Credential Transmission**: When the user clicks or connects dots, the client sends the assigned random session values instead of the raw dot IDs. The backend maps the received random tokens back to the dot identifiers via an array lookup to verify against the stored pattern in `user_pass`. - **Complex Strings via Predefined Values**: Rishi demonstrates that clicking dots can also append multi-character strings with symbols (such as alphanumeric substrings) to form a high-entropy string automatically from simple geometric inputs. - **Weaknesses and Mitigations**: A major limitation is shoulder surfing or surveillance via CCTV. Rishi explores potential counter-measures, such as disabling visual cues or experimenting with deceptive/false color feedbacks.

### Takeaways & Future Roadmap Graphical passwords serve as an accessible primary authentication method or as an additional authentication step for web platforms. Rishi outlines ongoing and planned developments, including a WordPress authentication plugin, true HTML5 path/line drawing, mathematical color-palette fill grids, handwriting/signature dot-density analysis, and a follow-up paper focused on testing and attacking graphical password schemes.