International Journal of Scientific Research in _______________________________ Survey Paper . Computer Science and Engineering Vol.6, Special Issue.1, pp.77-80, January (2018) E-ISSN: 2320-7639 A survey of Possible Attacks on Text & Graphical Password Authentication Techniques Sanjay E. Pate Bhojaraj H. Barhate Department of Computer Science, Department of Computer Science Nanasaheb Y.N.Chavan Arts,Science & Commerce Bhusawal Arts, Science & P.O.Nahata Commerce College, College,Chalisgaon, Dist.Jalgaon Bhusawal Abstract- The process of verifying a user's identity is typically referred to as user authentication. Information Security and Authentication is now a key issue in the world. Gradually end users of Internet improved. General uses of the Internet are searching, e-mail, social networking, e-banking, e-governance, etc. User Authentication is the process of determining whether the user should be authorized to access information or not. Alphanumeric or text passwords are mostly used mechanism for authentication. But these are susceptible to a dictionary, brute force and guessing attacks. Resolution is to use Graphical Password, is more secure, reliable technique for authentication. Graphical passwords allow users to remember pictures/images instead of text which helps them to remember the passwords easily. But these are also vulnerable to the dictionary, brute force and guessing attacks. In this paper, Text-based password and graphical password techniques for Authentication are just discussed, and possible attacks on them are summarized. KEYWORDS: Phishing, bots, OCR, PIN uses who you are? Single, measurable characteristic of an Introduction: individual (e.g., Iris, fingerprint) [15,5]. Passwords are the way used most frequently for Among the three techniques, the knowledge-based technique authenticating computer users, but this method has often is widely used for authentication because it is well known to shown insufficient in preventing unauthorized access to all areas of users and easy to implement. computer resources when used as the only means of Token-based and Biometric based authentications are more authentication. In public and private computer networks secure than knowledge-based authentication but, those including the Internet, authentication is done through the use techniques have their limitations. In the case of Token based of Login IDs (user name) and passwords. User authentication, the token should always be carried for authentication means that allows a device to verify the locating the service, and there is a possibility of missing the identity of someone who connects to a network resource. token or the token being stolen by somebody. To bypass the Natures of Authentications: usage of stolen tokens, an expansive token based There are three basic methods for authentication – authentication uses PIN (Personal Identification Number) in a. Knowledge-based authentication addition to tokens for authentication. Biometric b. Token-based authentication authentication is not but adopted for all applications because c. Biometric-based authentication [7,11,6]. of the expenditure involved in maintaining the special devices. For authentication, Knowledge-based authentication In common, the three techniques can be used for various technique uses something the user knows (e.g., text types of applications based on the security requirements. In passwords, graphical passwords, etc.), Token-based the present situation, every user has to maintain the number authentication technique uses something the user has (e.g., of user accounts either for office work or private work. smart card) and Biometric based authentication technique Biometrics or Tokens can be used for applications with high- security requirements, and knowledge-based authentication can be used for other applications. © 2018, IJSRCSE All Rights Reserved 77 Int. J. Sci. Res. in Computer Science and Engineering Vol.6(1), Jan 2018, E-ISSN: 2320-7639 The traditional method used for knowledge-based password complexity depends on the number and the length authentication is textual passwords. of the strokes in the password. But it is difficult to remember the order of the multiple strokes in random shape passwords. Drawing a password with the mouse is inconvenient. 1. Textual passwords: Cued recall systems are useful in memorability. Cues help A textual password is a conventional method used for user the users to retrieve the passwords from memory without authentication. It remains the most widely used method writing anywhere. The security of passwords in cued recall because it is simple, inexpensive compared to other system depends on the image selected for authentication. techniques and easy to implement [8,2]. Users are likely to Images will be having the limited number of clickable points select short and straightforward passwords to remember for password selection which reduces the password space, easily. It is effortless for the interloper to break these simple and in turn, passwords are vulnerable to password guessing attacks. These are vulnerable to password capturing attacks passwords. Random and lengthy passwords are hard to because entire password or user’s portfolio will be displayed remember. The main problem with the traditional textual for every login which can be observed by the intruders. method is that passwords selected for many applications are Password creation and login times are more compared to either weak and memorable or secure but difficult to recall systems. recognize [13,9]. Some users even use the name of the system as password [12]. The lengthy passwords provide II. Literature Review: more security but, it is difficult to remember several such Security of passwords can be specified in relations of long passwords. It is a tendency that users use the same resistance to various types of attacks. An attack is an attempt password for many accounts to reduce the load on the to deed vulnerabilities in the passwords. memory which makes interloper’s job easy [1,3]. It is easy Attacks can be categorized into password guessing attacks to capture the textual password either by shoulder surfing or and password capturing attacks. Password guessing attacks by malware. So the textual passwords are vulnerable to include brute force, dictionary and (personalized) guessing dictionary, (personalized) guessing and capturing attacks. To attacks. Password capturing attacks include shoulder surfing, address the problems of textual passwords, Graphical hidden camera, social engineering and malware attacks. passwords are introduced. Password guessing attacks has been resisted by having a 2. Graphical Passwords: large password space and strong passwords. Password Graphical passwords can be categorized into three methods capturing attacks can be resisted by introducing recognition based, recall based and cued recall based on the authentication techniques which depend on the secret cognitive load on the user in retrieving the passwords from entered by the user as well as the login interface. Security memory [16, 15, and 6]. may be increased by adding multiple rounds in the Recognition based techniques are useful in memorability; authentication technique at the cost of usability. Though it is users can remember and recognize the passwords desirable to have higher values for security and usability, successfully. The server has to maintain the large number of images or faces and for every round of authentication server due to the tradeoff between them, an optimal solution will be has to prepare the challenge set for every user. Due to the selected depending on the application. limited number of images in the challenge set and few I. Attacks on Text and Graphical password : rounds used for authentication, the password space is less in A. Brute Force Attack: recognition based techniques and turn these are vulnerable to Success of this attack depends on the set of predefined password guessing attacks. The Password capturing attacks values. If it is larger, it will take more time, but there is require multiple logins to get the complete portfolio of the better probability of success.However, GUA proves to be user. The password creation time and login times are more, more resistant to brute force attacks since the attack software compared to recall based techniques. needs to produce all possible mouse motions to imitate passwords especially when trying to recall the graphical Recall based techniques have large password space and are passwords [4]. secure against password guessing attacks. There is no need B.Dictionary Attack : to maintain a large number of images or faces by the server This creative attack uses words found in the dictionary to and no requirement of forming the challenge set. The check if any were used as passwords by the users. Many Password creation and login times are less than the other two users use weak passwords which make it easier for attackers techniques. The recall based techniques are vulnerable to to guess the password using the graphical dictionary attack password capturing attacks because in a single session or by [10]. Because of graphical password method of using mouse only observation the intruder may get the password. The input type recognition, using the dictionary attack on GUA © 2018, IJSRCSE All Rights Reserved 78 Int. J. Sci. Res. in Computer Science and Engineering Vol.6(1), Jan 2018, E-ISSN: 2320-7639 would be a waste of time. Dictionary attacks against D. Shoulder-Surfing Attack recognition and cued-recall graphical password