{"id":13323,"date":"2021-12-09T20:36:31","date_gmt":"2021-12-10T01:36:31","guid":{"rendered":"https:\/\/carleton.ca\/scs\/?page_id=13323"},"modified":"2026-06-02T14:59:23","modified_gmt":"2026-06-02T18:59:23","slug":"tr-10-07-purely-automated-attacks-on-passpoints-style-graphical-passwords","status":"publish","type":"page","link":"https:\/\/carleton.ca\/scs\/research\/scs-technical-reports\/technical-reports-2010\/tr-10-07-purely-automated-attacks-on-passpoints-style-graphical-passwords\/","title":{"rendered":"TR-10-07: Purely Automated Attacks on PassPoints-Style Graphical Passwords"},"content":{"rendered":"\n
\n
\n\n
\n
\n
\n

\n TR-10-07: Purely Automated Attacks on PassPoints-Style Graphical Passwords\n <\/h1>\n \n \n <\/header>\n\n <\/div>\n\n <\/div>\n\n <\/div>\n<\/section>\n\n

Carleton University
\nTechnical Report<\/a> TR-10-07
\nMarch 22, 2010<\/p>\n\n\n\n

Purely Automated Attacks on PassPoints-Style Graphical Passwords<\/h2>\n\n\n\n
\n
\n
\n
\n
\n
\n
\n
\n

P.C. van Oorschot, Amirali Salehi-Abari, Julie Thorpe<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

Abstract<\/h3>\n

We introduce and evaluate various methods for purely automated attacks against PassPoints-style graphical passwords. For generating these attacks, we introduce a graph-based algorithm to efficiently create dictionaries based on heuristics such as click-order patterns (e.g., 5 points all along a line). Some of our methods combine click-order heuristics with focus-of-attention scan-paths generated from a computational model of visual attention, yielding significantly better automated attacks than previous work. One resulting automated attack finds 7-16% of passwords for two representative images using dictionaries of approximately 2^26 entries (where the full password space is 2^43). Relaxing click-order patterns substantially increased the attack efficacy albeit with larger dictionaries of approximately 2^35 entries, allowing attacks that guessed 48-54% of passwords (compared to previous results of 1% and 9% on the same dataset for two images with 2^35 guesses). These latter attacks are independent of focus-of-attention models, and are based on image-independent guessing patterns. Our results show that automated attacks, which are easier to arrange than human-seeded attacks and are more scalable to systems that use multiple images, pose a significant threat to basic PassPoints-style graphical passwords.<\/p>\n

TR-10-07.pdf<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Carleton University Technical Report TR-10-07 March 22, 2010 Purely Automated Attacks on PassPoints-Style Graphical Passwords P.C. van Oorschot, Amirali Salehi-Abari, Julie Thorpe Abstract We introduce and evaluate various methods for purely automated attacks against PassPoints-style graphical passwords. For generating these attacks, we introduce a graph-based algorithm to efficiently create dictionaries based on heuristics such as […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":12468,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_cu_dining_location_slug":"","footnotes":"","_links_to":"","_links_to_target":""},"cu_page_type":[],"class_list":["post-13323","page","type-page","status-publish","hentry"],"acf":{"cu_post_thumbnail":false},"_links":{"self":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/comments?post=13323"}],"version-history":[{"count":1,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13323\/revisions"}],"predecessor-version":[{"id":13324,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/13323\/revisions\/13324"}],"up":[{"embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/pages\/12468"}],"wp:attachment":[{"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/media?parent=13323"}],"wp:term":[{"taxonomy":"cu_page_type","embeddable":true,"href":"https:\/\/carleton.ca\/scs\/wp-json\/wp\/v2\/cu_page_type?post=13323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}