Graphical Passwords for Emergent Users: A Four-Day Recall Comparative Study on PIN, Passfaces and Celebrities

Numerical passwords (or PINs) are a commonly used “what you know” password mechanism. However, numbers could be difficult to remember, and particularly for emergent users. Graphical passwords, and especially Passfaces (passwords based on human faces) could be an alternative, as we humans remember and recognise other human faces easily. Further, we posit that if these human faces happen to be of well-known personalities (such as celebrities), these should be even easier to remember. In this paper, we present a within-subjects, counterbalanced, longitudinal study with 66 emergent users that systematically compares the performance of PINs with Passfaces of two types, one composed of unknown people (Passfaces for short) and Passfaces based on celebrities (Celebrities for short). In our study, Passfaces and Celebrities had a larger password space by design (and hence, arguably, were more secure) than PINs. Users were asked to memorise each password, and recall the same after a distraction task and after a period of 4 days. The analysis of the results showed that the 4-day memorability of PINs (90%) and Celebreties (93%) were both significantly better than Passfaces (77%). While people took significantly more time to set up a Celebrities password (180 s) compared to PIN (101 s) and Passfaces (138 s), they took significantly more time to recall a Passfaces password (87 s) compared to PIN (42 s) and Celebrities (45 s). We present an analysis of the security and memorability of the faces used in Passfaces and Celebrities. We discuss the implications of our results on the design of password mechanisms for emergent users.