{'fraction_non_alphanumeric': 0.012648809523809524, 'fraction_numerical': 0.001488095238095238, 'mean_word_length': 4.723404255319149, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Is it better to choose seen or unseen distracters for graphical passwords

We investigate a form of recognition-based graphical passwords where users choose their pass images from a system provided collection. In these systems the user is presented with a challenge set containing their pass images, together with distracters, when they login. They need to recognise their pass images to gain access. The distracters come from the same system provided collection and can be either images that the user has already seen when registering or images that they have not seen. Our experiment investigates which approach is more usable, measured by login accuracy and login time. Our results show that it is better to use images that the user has already seen as distracters. This does not affect the accuracy but leads to faster login times. In our experiment users were presented with one 60 images challenge set that contained both their pass images and distracters. Most login errors were caused by choosing the two images in the wrong order. Participants also thought that the system was easier to use than text based passwords, both when registering and logging in. They also suggested using three images rather than two for more security. This suggests that a more usable system would have three pass images that could be selected in any order.