Eye Tracking & Graphical Paswords

1. Eye Tracking & Graphical Paswords Ülkü ARSLAN AYDIN Murat AYDIN

2. Who are we? Murat AYDIN Senior Software Eng. at STM (maydin@stm.com.tr) M.S.: Metu Software Eng.(2008) B. Sc: Metu Computer Eng.(2004) Ülkü ARSLAN AYDIN System Analyst at SPK (uarslan@spk.gov.tr) M.S.: Metu Cognitive Science(expected 2011) B. Sc: Hacettepe Computer Eng.(2005)

3. Outline Characteristics and Methods Usability Engineering Graphical Password Experiment

4. Why eye? . • Problem: • Constrained interfacebetween two • powerful information processors Goal: increase the bandwidth across the channel Why Eye?>> Characteristics and Methods

5. Why eye? The Mind-Eye Hypothesis People generally do tend to look at the same think that they are thinking about. Why Eye?>> Characteristics and Methods

6. Why eye? • Eyes are extremely rapid “...the most frequent of all human movements” (Bridgeman, 1992) • Target acquisition:look at the target first before actuating • Direction of gaze implicitly indicates the focus of attention • Facilitates hands free operation • Eye movements are natural, little conscious effort Why Eye?>> Characteristics and Methods

7. Structureof the Eye Cornea is a transparent structure thatcovers the iris and pupil • Retina includes • rods (94%) • (light sensitive) • cones (6%) • (color sensitive) Pupil allows varying amounts of light to enter the eye. Fovea is the central area of retina Lens helps to focus light on theretina Structure of the eye>> Characteristics and Methods

8. Eye Movements Eyes move all the time (even during sleep) Combinations of basic types Eye Movements >> Characteristics and Methods

9. Saccades to a new location Rapid simultaneous movement of both eyes both voluntary and reflexive 10 ms to 100 ms cannot be altered Saccades>> Characteristics and Methods

10. Fixations Stabilize the retina Fixational eye movements occurs involuntarily Tremor+drift+microsaccades 120 ms to 1000 ms Fixations>> Characteristics and Methods

11. Smooth Pursuits to closely follow a moving object is modified by ongoing visual feedback better at downward than upward pursuit better at horizontal than vertical smooth pursuit Smooth Pursuits>> Characteristics and Methods

12. History & Methods Eye Tracker: The measurement device used for measuring eye movements. History & Methods >> Characteristics and Methods

13. History & Methods History & Methods >> Characteristics and Methods

14. History & Methods Video- based Combined pupil and corneal reflection to provide point of regard measurement Head must be fixed Multiple ocular features must be measured Table mounted Head mounted History & Methods >> Characteristics and Methods

15. Passively and Actively Passively : monitor eye activity for later study and analysis. • Behavioural scientist » what pilots or control room operators look at • Reading specialist » when a person is reading/fixating on a word • Marketing researcher » what features/product advertising attract buyyer attention. Actively: actively direct a computer through the motions of eyes • Disabled people » operate computers with their eyes. • Hospitals » eye-aware communication program

16. History & Methods A wide variety of disciplines use eye tracking techniques, History & Methods >> Characteristics and Methods

17. Eye Tracking Equipment Vendors Arrington LC Tobii nac SR SMI Eye Tracking Equipment Vendors >> Characteristics and Methods

18. Outline Characteristics and Methods Usability Engineering Graphical Password Experiment

19. Goals of Eye Tracking Studies for usability studies Goals of Eye Tracking Studies >> In Usability Engineering

20. Eye Tracking Research Qualitative studies Usability Methods Aim to collect richer insights and observations Quantitative studies Measures usability data numerically Eye Tracking Research Eye Tracking Research >> In Usability Engineering

21. Eye trackers ability Can • whether users are looking at the screen or not. • differentiatereading from scanning • user’s attention to various parts • whether a user is searching • users’ overall scan patterns. Can not • whether users actually “see” • prove that users did not see • why users are looking at something. • testeverybody

22. Eye Tracking Metrics Usability researcher must choose eye tracking metrics for each usability study individually. Eye Tracking Metrics >> In Usability Engineering

23. Eye Tracking Metrics Fixation A relatively stable eye-in-head position within some threshold of dispersion(~2º) over some minimum duration (typically 100-200 ms). Fixation numbers should reflect the importance of the specific element. Fixations each circles Fixation duration width of circles Eye Tracking Metrics >> In Usability Engineering

24. Eye Tracking Metrics Gaze Duration It is a cumulative duration.Typically includes several fixations and may include the relativelly short saccades between these fixations. Long gazes should be resulted from diffucult interpreting process. Gaze Duration group of circles Eye Tracking Metrics >> In Usability Engineering

25. Eye Tracking Metrics Area of interest Area of a display or visual environment that is of interest to the research or design team and thus defined by them (not by participant). Eye Tracking Metrics >> In Usability Engineering

26. Eye Tracking Metrics Scan Path Spatial arrangement of a sequence of fixations. It can indicates the efficiency of arrangement of elements in the user interface. Scan Path sequence of circles Eye Tracking Metrics >> In Usability Engineering

27. Eye Tracking Metrics HeatMaps Shows how much users looked at different parts of a Web page. Areas where the users looked the most are colored red. The yellow areas indicate fewer fixations, followed by the least-viewed blue areas.Other areas didn’t attract any fixations. Eye Tracking Metrics >> In Usability Engineering

28. Eye Tracking Metrics Other Promising Eye Tracking Metrics • Number of gazes on each area of interest • Number of involuntary and number of voluntary fixations • Percentage of participants fixating an area of interest • Time to 1st fixation on target area of interest Eye Tracking Metrics >> In Usability Engineering

29. Outline Characteristics and Methods Usability Engineering Graphical Password Experiment

30. Motivation Security Systems Classification of authentication techniques Suo et al. (2005) Motivation >> Graphical Password Experiment

31. Motivation Usable Security Two dilemmas of password problem; secure but difficult to remember or memorable but insecure1 Usability Security 1)Chiasson et al. (2008) Motivation >> Graphical Password Experiment

32. Motivation Graphical password vs. Text passwords • Picture superiority effect dual-code theory Paivio (1971) • Affected from ageing less (Park, 1986) Assumption 1: Graphical passwords are memorable than text passwords. based on Picture superiority effect1 1) Nickerson (1965) Motivation >> Graphical Password Experiment

33. Motivation Schema theory Asssumption 2: High schema objects in the room remembered better based on Schema theory and William F. study Without Schema Schema based Motivation >> Graphical Password Experiment

34. Background Relevant Research Domain • How to analyze Usability of Password • How to analyze Security of Password • Categorization of Graphical Passwords Background >> Graphical Password Experiment

35. Background Usability Aspect Number of correct entries elapsed time and cost pre-tests or questionnaires * Target user ,tasks and domain Lashkari et al. (2009) , Biddle et al. (2010) Background >> Graphical Password Experiment

36. Background Security Aspect • Brute Force • Dictionary Attacks • Guessing • Spyware • Shoulder Surfing • Social Engineering

37. Methods Research Question Is there any significant difference between schema-based and separated images approaches according to the security and usabilityaspects Methods>> Graphical Password Experiment

38. Methods Pilot Study Methods>> Graphical Password Experiment

39. Methods Methodology Methods>> Graphical Password Experiment

40. Results • data is collected 4 ways; by eye-tracker, by fNIR, by software and by questionnaires. • Eye tracker results: • There is a significant main effect of the task type on the fixation count, F(1,24)=3,32, p<.05. • There is not any significant effect of AIO type on fixation duration, F(8,24) =0.53, p>.05. • There is not any significant effect of picture type (separated vs. schema based) on fixation count F(1,24)=0,90, p>.05. • There is a significant main effect of the type of AOI(Area of Interest) on the fixation count, F(8,24) =2,75, p<.05. Results >> Graphical Password Experiment

41. Conclusion • Although progress has been slow, the concept of using eye tracking in human computer interaction is clearly beginng to blossom. • We can see this growth in the establishment of a new conference series covering this area. • It is believen that the technology is maturing and has already delivered promising results.

42. References • Goldberg, J., Hangman, J., Sazawal, V., 2002. Doodling our way to better authentication. CHI 2002 Extended Abstracts, pp. 868–869. • Herley, C., Oorschot, P.C., Patrick, A., (2009). Passwords: If We’re So Smart, Why Are We Still Using Them? in Financial Cryptography and Data Security, LNCS5628, Springer • Jacko, J.A. & Sears, A., (2003) The human-computer interaction handbook: Fundamentals, evolving technologies and emerging applications. Mahwah, NJ: Lawrence Erlbaum. • Jermyn, I., Mayer, A., Monrose, F., Reiter, M.K., Rubin, A.D., (1999). The design and analysis of graphical passwords. Proceedings of the 8th USENIX Security Symposium, pp. 1–14. • Kintsch, W., (1970). Models for free recall and recognition. In D. Norman, editor, Models of human memory, chapter Models for free recall and recognition. Academic Press: New York • Lashkari A.H, Zakaria O., Salleh R., Farmand S., (2009). A wide-range survey on Recall-Based Graphical User Authentications algorithms based on ISO and Attack Patterns. International Journal of Computer Science and Information Security (IJCSIS), Vol. 6, No. 3 • Tulving, E. and Pearlstone, Z. 1966. Availability versus accessibility of information in memory for words. Journal of Verbal Learning and Verbal Behavior 5, 381–391.

43. Thanks for Listening Comments & Questions?