Publication Details

Download

Mohamed Khamis, Regina Hasholzner, Andreas Bulling, Florian Alt
GTmoPass: Two-factor Authentication on Public Displays Using Gaze-Touch passwords and Personal Mobile Devices
In PerDis 2017: Proceedings of the 6th ACM International Symposium on Pervasive Displays. Lugano, Switzerland, June 7-9, 2017. ACM, New York, NY, USA. (bib)

As public displays continue to deliver increasingly private andpersonalized content, there is a need to ensure that only thelegitimate users can access private information in sensitive con-texts. While public displays can adopt similar authentication concepts like those used on public terminals (e.g., ATMs), authentication in public is subject to a number of risks. Namely, adversaries can uncover a user's password through (1) shoulder surfing, (2) thermal attacks, or (3) smudge attacks. To address this problem we propose GTmoPass, an authentication architecture that enables multi-factor user authentication on public displays. The first factor is a knowledge-factor: we employ a shoulder-surfing resilient multimodal scheme that combines gaze and touch input for password entry. The second factor is a possession-factor: users utilize their personal mobile devices, on which they enter the password. Credentials are securely transmitted to a server via Bluetooth beacons. We describe the implementation of GTmoPass and report on an evaluation of its usability and security, which shows that although authentication using GTmoPass is slightly slower than traditional methods, it protects against the three aforementioned threats.