Observable password inputs

Question

An obvious problem with passwords is that if an observer sees a user enter it, then the user has lost the password secrecy. Some systems try to defend against this with dark screens or with shields around button inputs.

I was wondering if there are any implementations or research into "complete knowledge" password systems. In other words, an observer can observe and record all the things observable to the user, such as screen and keyboard and sounds, and still not be able to enter a valid password.

For example, the screen could display X, and the user could mentally compute Y = f(X), and input Y. F is a function known only to the user; it could be a number of things like word games or graphical transforms or mathematical or a combination of all of them.

A few problems I see with this: if f is too complex, the user won't be remember or compute it. If it is too simple, the observer will be able to guess it. Also, it seems like a lot more work than physically obscuring the view.

Still I wonder if anyone does research into this subject, and if there is any terminology for it. Thanks~

PS I apologize if this question has been asked before, I'm not sure what the common terms are for this subject to search for. Also, I have migrated this question from the UX stackexchange, from https://ux.stackexchange.com/q/89185/78288

Answer 1

I don't recall hearing about a proposed authentication scheme where the user has to compute, essentially, a one-time password in their head. I agree with you that most users would probably not be accepting of such a system, especially if it were designed with enough security to resist being easily reverse engineered by an attacker that can observe the challenge prompts and responses. Here's one paper that proposes a slightly different system for entering PINs: How to Fend Off Shoulder Surfers.

You also mention graphical passwords, and I do know that there has been sustained work in this area to combat 'shoulder surfing'. But I believe even they don't claim to be impervious to attackers who have prolonged observation capabilities, just more resistant than other authentication systems. I can point you to a few related papers if you care to delve further into the subject:

• You Only Live Twice or "The Years We Wasted Caring About Shoulder-Surfing"
• Shoulder Surfing Defence for Recall-Based Graphical Passwords
• Shoulder-Surfing Resistance with Eye-Gaze Entry in Cued-Recall Graphical Passwords
• A Comparison of Perceived and Real Shoulder-Surfing Risks Between Alphanumeric and Graphical Passwords

For situations where all visual and audio data are susceptible to observation we typically rely on an authentication system where there is no observable data leaked. This can be something like RFID cards, smart cards, certain types of biometrics, etc. When these options aren't available, or are combined with knowledge like an ATM PIN, we typically try to implement the controls you mentioned to reduce the possibility of illicit observation.