I've read a lot of theory about graphic passwords and how people remember them. I wanted to test the theory, so I created an application that allowed people to create textual and graphic passwords and recall them after some distraction tasks. The graphic passwords were a combination of choosing an image from a grid and then positioning the chosen images on a canvas. In both cases, the only restriction was that the passwords weren't blank. I've already had people run through the application so I have some data to work with.
I want to test two hypotheses:
Hypothesis 1: People will choose passwords with equal effective strengths in both methods
Hypothesis 2: People will be able to recall their passwords equally well
I'm looking for any high-level or algorithmic advice knowledgeable people can give on testing these hypotheses. My thoughts after talking to my academic supervisor and a mathematician friend are below:
- We should follow an established procedure for scoring textual passwords and attempt to generate a strength score that follows the same distribution for the graphical passwords. We can then compare the distributions based on knowledge of the theoretical password spaces.
- I'm looking for a way to compare 2 sets of semi-scientific scores representing the effective password spaces that are broken down into groups of passwords generated per person, whilst having a more scientific understanding of the theoretical password spaces.
- Although we have data about the Levenshtein distances of the passwords, the reality is that passwords are generally either right or wrong based on whether they are an exact match. With this in mind, we also have produced binary data for each password attempt. Unfortunately I don't know how to compare the binary data well other than taking a simple average although I've heard it's possible with binomial distribution.
- Since each person recalled 3 passwords 2 times, I'm looking for a statistical method that takes into account the the person, the amount of distraction they've had (i.e. 5 minutes or 15 minutes) and whether the entry was an exact match or not to give some indication of how likely people are to get a password wrong after 5 or 15 minutes of distraction. I will also need to know if this difference is significant.