Touch gesture-based authentication: A security analysis of Pattern Unlock

Pattern Unlock is one in a family of graphical passwords used on smart mobile devices. They were proposed as an alternative to PIN and Password, as a result of a study [2] that showed better human memorability of visuals words than textual. Researchers have made several attempts to analyse and quantify the security of Pattern Unlock. However, only a few studies have been done on human characteristics and the correlation to choice of patterns. In this paper, we investigated the Android Pattern Unlock authentication and presents a comprehensive analysis of user pattern characteristics and strength of patterns generated by users. We extended the analysis by looking indepth into gender and also different Android operated devices were looked into to get the lock-out and wait time, to lay the foundations of a practical security framework. Our results (125 participants) indicated how users weakly choose their patterns by simply embedding and reusing patterns that are alphabetic or numeric-like, and having a strength score less than 27bits of entropy. The results highlighted the need to make users more aware and conscious when choosing their authentication patterns.