{"id":13285,"date":"2021-12-08T21:03:57","date_gmt":"2021-12-09T02:03:57","guid":{"rendered":"https:\/\/carleton.ca\/scs\/?page_id=13285"},"modified":"2026-06-02T14:59:23","modified_gmt":"2026-06-02T18:59:23","slug":"tr-08-21-on-predicting-and-exploiting-hot-spots-in-click-based-graphical-passwords","status":"publish","type":"page","link":"https:\/\/carleton.ca\/scs\/research\/scs-technical-reports\/technical-reports-2008\/tr-08-21-on-predicting-and-exploiting-hot-spots-in-click-based-graphical-passwords\/","title":{"rendered":"TR-08-21: On Predicting and Exploiting Hot-Spots in Click-Based Graphical Passwords"},"content":{"rendered":"\n
\n
\n\n
\n
\n
\n

\n TR-08-21: On Predicting and Exploiting Hot-Spots in Click-Based Graphical Passwords\n <\/h1>\n \n \n <\/header>\n\n <\/div>\n\n <\/div>\n\n <\/div>\n<\/section>\n\n

Carleton University
\nTechnical Report<\/a> TR-08-21
\nNovember 7, 2008<\/p>\n\n\n\n

On Predicting and Exploiting Hot-Spots in Click-Based Graphical Passwords<\/h2>\n\n\n\n
\n
\n
\n
\n
\n
\n
\n
\n

P.C. van Oorschot & J. Thorpe<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Abstract<\/h3>\n

We provide an in-depth study of the security of click-based graphical password schemes like PassPoints (Weidenbeck et al., 2005), by exploring popular points (hot-spots), and examining strategies to predict and exploit them in guessing attacks. We report on both short- and long-term user studies: one lab-controlled, involving 43 users and 17 diverse images, the other a field test of 223 user accounts. We provide empirical evidence that hot-spots do exist for many images, some more so than others. We explore the use of “human-computation” (in this context, harvesting click-points from a small set of users) to predict these hot-spots. We generate two “human-seeded” attacks based on this method: one based on a first-order Markov model, another based on an independent probability model. Within 100 guesses, our first-order Markov model-based attack guesses 4% of passwords in one instance, and 10% of passwords in a second instance. Our independent model-based attack guesses 20% within 2^33 guesses in one instance and 36% within 2^31 guesses in a second instance. These are all for a system whose full password space has cardinality 2^43. We also evaluate our first-order Markov model-based attack with cross-validation of the field study data, finding that it guesses an average of 7-10% of user passwords within 3 guesses. Our results suggest that these graphical password schemes (as originally proposed) are vulnerable to offline and online attacks, even on systems that implement conservative lock-out policies.<\/p>\n

TR-08-21.pdf<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Carleton University Technical Report TR-08-21 November 7, 2008 On Predicting and Exploiting Hot-Spots in Click-Based Graphical Passwords P.C. van Oorschot & J. Thorpe Abstract We provide an in-depth study of the security of click-based graphical password schemes like PassPoints (Weidenbeck et al., 2005), by exploring popular points (hot-spots), and examining strategies to predict and exploit […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":12410,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_cu_dining_location_slug":"","footnotes":"","_links_to":"","_links_to_target":""},"cu_page_type":[],"class_list":["post-13285","page","type-page","status-publish","hentry"],"acf":{"cu_post_thumbnail":false},"_links":{"self":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/comments?post=13285"}],"version-history":[{"count":1,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13285\/revisions"}],"predecessor-version":[{"id":13287,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13285\/revisions\/13287"}],"up":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/12410"}],"wp:attachment":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/media?parent=13285"}],"wp:term":[{"taxonomy":"cu_page_type","embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/cu_page_type?post=13285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}