The development of reliable authentication schemes faces significant challenges due to security vulnerabilities, like shoulder-surfing and impersonation attacks. In this article, we present a six-month in-lab study (N = 30), on a novel two-factor authentication prototype combining Microsoft’s Picture Gesture Authentication (PGA) with Electroencephalography (EEG). The premise of this study was to explore the users’ unique neural responses that are triggered during the authentication process to train individual AI models that would mitigate impersonation attacks. We also investigated whether users’ familiarity with the PGA’s background image affects the authentication accuracy. Participants completed 20 trials using familiar and unfamiliar background images. Results indicate that familiar stimuli and users’ muscle activity improve cognitive efficiency and authentication accuracy. Additionally, combining time-frequency domain features with Support Vector Machines, yielded optimal results. These findings highlight the potential of utilizing EEG-based technology in graphical authentication systems, offering secure and user-friendly alternatives to traditional methods.

Phishing attacks constitute a significant cyberthreat, causing financial losses and undermining digital trust. Despite advancements in awareness campaigns and regulatory efforts, many individuals and organizations struggle to understand their legal rights and obligations when victimized by phishing. This paper presents a benchmark framework designed to support researchers in the analysis of legal texts and cases, with the goal of helping users navigate the complex legal landscape surrounding phishing attacks. We evaluate BERT-based models, large language models, and retrieval-augmented generation using a curated knowledge base of phishing laws, regulations, and common scenarios. We provide baseline evaluations across multiple task categories, including true-false questions, phishing attack cases, penal code analysis, legal cases with judicial decisions, and question-answering tasks, all within the Greek legal jurisdiction.

The development of secure and effective identification/authentication systems is an ongoing challenge in the field of computer science, as new techniques and methods continue to emerge. In the context of this ever-evolving landscape, we propose a new multi-factor authentication system. The proposed system combines Picture Gesture Authentication (PGA) with simultaneous acquisition of users' brain signals (EEG) to enhance security. To assess the efficacy of the proposed model, we collected data from 14 individuals, each of whom participated in 20 trials to create a single-person authentication system. Features were extracted and multiple machine learning algorithms were trained and tested in three different scenarios. The first scenario utilized the created dataset to find the most effective machine learning algorithms and features; the second applied augmentation techniques for a more balanced dataset; the third used only the most important features. The results were encouraging, indicating that the proposed model works well in enhancing the level of security.

This literature review surveys published research that aims to foster blind and visually impaired (VI) people’s engagement with cultural heritage. The reviewed papers cover a broad area of methodological approaches, outlining challenges and solutions for empowering VI people to enjoy cultural heritage sites and museums, mainly with the use of Information and Communication Technologies (ICT). Fifty (50) papers are included in this survey, published between 2008 and 2021. They mostly focus on multisensory, multimodal and interdisciplinary, ICT-based assistive human-centered computing approaches. These methods often optimize the VI user experience through an effort to gain an in-depth understanding of this special group’s needs. Moreover, several publications include user evaluations and empirical studies. Findings suggest that approaches tend to become more complex, multimodal, and multidisciplinary as time progresses. This leads to a discussion and conclusions suggesting future research directions in this domain. The proposed way forward relates to a synthesis of methodologies, scientific domains, and approaches into a more holistic, comprehensive, and synergetic model.

Abstract Phishing is one of the most important security threats in modern information systems causing different levels of damages to end-users and service providers such as financial and reputational losses. State-of-the-art anti-phishing research is highly fragmented and monolithic and does not address the problem from a pervasive computing perspective. In this survey, we aim to contribute to the existing literature by providing a systematic review of existing experimental phishing research that employs EEG and eye-tracking methods within multi-modal and multi-sensory interaction environments. The main research objective of this review is to examine articles that contain results of at least one EEG-based and/or eye-tracking-based experimental setup within a phishing context. The database search with specific search criteria yielded 651 articles from which, after the identification and the screening process, 42 articles were examined as per the execution of experiments using EEG or eye-tracking technologies in the context of phishing, resulting to a total of 18 distinct papers that were included in the analysis. This survey is approaching the subject across the following pillars: a) the experimental design practices with an emphasis on the applied EEG and eye-tracking acquisition protocols, b) the artificial intelligence and signal preprocessing techniques that were applied in those experiments, and finally, c) the phishing attack types examined. We also provide a roadmap for future research in the field by suggesting ideas on how to combine state-of-the-art gaze-based mechanisms with EEG technologies for advancing phishing research. This leads to a discussion on the best practices for designing EEG and gaze-based frameworks.

This article proposes a user-adaptable and personalized authentication paradigm for healthcare organizations, which anticipates to seamlessly reflect patients’ episodic and autobiographical memories to graphical and textual passwords aiming to improve the security strength of user-selected passwords and provide a positive user experience. We report on a longitudinal study that spanned over 3 years in which three public European healthcare organizations participated to design and evaluate the aforementioned paradigm. Three studies were conducted ( n = 169) with different stakeholders: (1) a verification study aiming to identify existing authentication practices of the three healthcare organizations with diverse stakeholders ( n = 9), (2) a patient-centric feasibility study during which users interacted with the proposed authentication system ( n = 68), and (3) a human guessing attack study focusing on vulnerabilities among people sharing common experiences within location-aware images used for graphical passwords ( n = 92). Results revealed that the suggested paradigm scored high with regard to users’ likeability, perceived security, usability, and trust, but more importantly it assists the creation of more secure passwords. On the downside, the suggested paradigm introduces password guessing vulnerabilities by individuals sharing common experiences with the end users. Findings are expected to scaffold the design of more patient-centric knowledge-based authentication mechanisms within today's dynamic computation realms.

In this paper, we propose an eye gaze-driven metric based on hotspot vs. non-hotspot segments of images for unobtrusively estimating the strength of user-created graphical passwords by analyzing the users' eye gaze behavior during password creation. To examine the feasibility of this method, i.e., the existence of correlation between the proposed metric and the strength of users' generated passwords, we conducted an eye-tracking study (n=42), in which users created a graphical password with a personalized image that triggers declarative memory of users (familiar image) vs. an image illustrating generic content unfamiliar to the users' episodic and semantic memory (generic image). Results revealed a strong positive correlation between the password strength and the proposed eye gaze-driven metric, pointing towards a new direction for the design of intelligent eye gaze-driven graphical password schemes for unobtrusively assisting users in making better password choices.

The Second International Workshop on Adaptive and Personalized Privacy and Security (APPS 2020) aims to bring together researchers and practitioners working on diverse topics related to understanding and improving the usability of privacy and security software and systems, by applying user modeling, adaptation and personalization principles. Our special focus in 2020 is on healthcare systems, more specifically on ensuring security and privacy of medical data in smart patient-centric healthcare systems. The second edition of the workshop includes interdisciplinary contributions from Austria, Canada, China, Cyprus, Denmark, Germany, Greece, Israel, the Netherlands, Turkey and the UK that introduce new and disruptive ideas, suggest novel solutions, and present research results about various aspects (theory, applications, tools) for bringing user modeling, adaptation and personalization principles into privacy and systems security. This summary gives a brief overview of APPS 2020, held online in conjunction with the 28th ACM Conference on User Modeling, Adaptation and Personalization (ACM UMAP 2020).

Picture passwords, which require users to draw selections on images as their secret password, typically provide globalized solutions without taking into consideration that people across diverse cultures exhibit differences within interactive systems. Aiming to shed light on the effects of culture towards users' interactions within picture password schemes, we conducted a between-subjects cross-cultural (Eastern vs. Western) study (n=67). Users created a password on a picture illustrating content highly related to their daily-life experiences (culture-internal) vs. a picture illustrating the same daily-life experiences, but in a different cultural context (culture-external). Results revealed that people across cultures exhibited differences in visual processing, comprehension, and exploration of the picture content prior to making their password selections. The observed differences can be accounted by considering sociocultural theories highlighting the holistic preference of Eastern populations compared to the analytic preference of Western populations. Qualitative data also triangulate the findings by exposing the likeability and users' engagement towards the picture content familiar to individual's culture. Findings underpin the necessity to consider cultural differences in the design of personalized picture passwords.

Future-generation healthcare systems will be highly distributed, combining centralised hospital systems with decentralised home-, work-and environment-based monitoring and diagnostics systems. These will reduce costs and injury-related risks whilst both improving quality of service, and reducing the response time for diagnostics and treatments made available to patients. To make this vision possible, medical data must be accessed and shared over a variety of mediums including untrusted networks. In this paper, we present the design and initial implementation of the SERUMS tool-chain for accessing, storing, communicating and analysing highly confidential medical data in a safe, secure and privacy-preserving way. In addition, we describe a data fabrication framework for generating large volumes of synthetic but realistic data, that is used in the design and evaluation of the tool-chain. We demonstrate the present version of our technique on a use case derived from the Edinburgh Cancer Centre, NHS Lothian, where information about the effects of chemotherapy treatments on cancer patients is collected from different distributed databases, analysed and adapted to improve ongoing treatments.

Graphical passwords leverage the picture superiority effect to enhance memorability, and reflect today's haptic users' interaction realms. Images related to users' past sociocultural experiences (e.g., retrospective) enable the creation of memorable and secure passwords, while randomly system-assigned images (e.g., generic) lead to easy-to-predict hotspot regions within graphical password schemes. What remains rather unexplored is whether the image type could be inferred during the password creation. In this work, we present a between-subjects user study in which 37 participants completed a recall-based graphical password creation task with retrospective and generic images, while we were capturing their visual behavior. We found that the image type can be inferred within a few seconds in real-time. User adaptive mechanisms might benefit from our work's findings, by providing users early feedback whether they are moving towards the creation of a weak graphical password.

Graphical passwords leverage the picture superiority effect to enhance memorability, and reflect today's haptic user interaction realms. Image content related to users’ past sociocultural experiences assists users with the creation of more secure and memorable passwords. Aiming to shed light on the effects of sociocultural-related image content towards graphical password selections, we conducted a between-subjects eye-tracking study (N=37) in which users selected one image among a set of images from their assigned image group (sociocultural-related vs. generic) that would be used for creating their graphical password. Results revealed differences in users’ interaction and visual behavior during image selection. Initial users’ feedback regarding the likeability and users’ engagement with the sociocultural-related image content is also presented.

State-of-the-art predictive user models, like Goals, Operators, Methods, and Selection Rules (GOMS) or Keystroke-Level Model (KLM), do not consider human differences in information processing, and do not model user interaction by also considering visual behavior patterns of users during task execution. This can be accredited mainly to insufficient methods and approaches on how to model such interdependencies and thus correlate users’ cognitive characteristics with their interaction and visual behavior during task execution, and ultimately considering such cognitive-centered user models practically within current state-of-the-art information systems’ personalization and adaptation approaches. In this paper, we elaborate on such an endeavor and propose a seven-step, gaze-based human cognitive-centered user model as a basis of synthesizing user cognitive styles along with their interaction and visual behavior patterns. Aiming to prove the validity of the suggested user model, we applied it in the context of an eye tracking study that investigated influences of users’ human cognitive differences on their visual behavior in user authentication within traditional desktop and mixed reality contexts. Initial results of the study are also reported.

Graphical password composition is an important part of graphical user authentication which affects the strength of the chosen password. Considering that graphical authentication is associated with visual search, perception, and information retrieval, in this paper we report on an eye-tracking study (N = 109) that aimed to investigate the effects of users’ cognitive styles toward the strength of the created passwords and shed light into whether and how the visual strategy of the users during graphical password composition is associated with the passwords’ strength. For doing so, we adopted Witkin’s Field Dependence-Independence theory, which underpins individual differences in visual information and cognitive processing, as graphical password composition tasks are associated with visual search. The analysis revealed that users with different cognitive processing characteristics followed different patterns of visual behavior during password composition which affected the strength of the created passwords. The findings underpin the need of considering human-cognitive characteristics as a design factor in graphical password schemes. The paper concludes by discussing implications for improving recognition-based graphical passwords through adaptation and personalization techniques based on individual cognitive characteristics.

Nowadays, technological advances introduce new visualization and user interaction possibilities. Focusing on the user authentication domain, graphical passwords are considered a better fit for interaction environments which lack a physical keyboard. Nonetheless, the current graphical user authentication schemes are deployed in conventional layouts, which introduce security vulnerabilities associated with the strength of the user selected passwords. Aiming to investigate the effectiveness of advanced visualization layouts in selecting stronger passwords, this paper reports a between-subject study, comparing two different design layouts a two-dimensional and a three dimensional. Results provide evidence that advanced visualization techniques provide a more suitable framework for deploying graphical user authentication schemes and underpin the need for considering such techniques for providing assistive and/or adaptive mechanisms to users aiming to assist them to create stronger graphical passwords.

Visual attention, search, processing and comprehension are important cognitive tasks during a graphical password composition activity. Aiming to shed light on whether individual differences on visual behavior affect the strength of the created passwords, we conducted an eye-tracking study (N=36), and adopted an accredited cognitive style theory to interpret the results. The analysis revealed that users with different cognitive styles followed different patterns of visual behavior which affected the strength of the created passwords. Motivated, by the results of the first study, we introduced adaptive characteristics to the user authentication mechanism, aiming to assist specific cognitive style user groups to create more secure passwords, and conducted a second study with a new sample (N=40) to test the adaptive characteristics. Results strengthen our assumptions that adaptive mechanisms based on users' differences in cognitive and visual behavior uncover a new perspective for improving the password's strength within graphical user authentication realms.

In this paper, we introduce a two-step method for estimating the strength of user-created graphical passwords based on the eye-gaze behaviour during password composition. First, the individuals' gaze patterns, represented by the unique fixations on each area of interest (AOI) and the total fixation duration per AOI, are calculated. Second, the gaze-based entropy of the individual is calculated. To investigate whether the proposed metric is a credible predictor of the password strength, we conducted two feasibility studies. Results revealed a strong positive correlation between the strength of the created passwords and the gaze-based entropy. Hence, we argue that the proposed gaze-based metric allows for unobtrusive prediction of the strength of the password a user is going to create and enables intervention to the password composition for helping users create stronger passwords.

Evidence suggests that individual cognitive differences affect users' memorability, visual behavior, and graphical passwords' security. Such knowledge denotes the added value of personalizing graphical password schemes towards the unique cognitive characteristics of the users. However, real-time and accurate cognition-based predictive user models are necessary to reach such a breakthrough. In this paper, we present the results of such an attempt, where an in-lab eye-tracking study was conducted with 36 participants who completed a recall-based graphical password composition task. We adopted a credible cognitive style theory, and investigated a variety of eye-tracking metrics to predict participants' cognitive styles. Results' analysis reveals that inferring individual cognitive differences in real-time during graphical password composition is feasible within a few seconds and that specific eye-tracking metrics correlate stronger with certain cognitive style groups. The findings further support the vision of incorporating real-time adaptive mechanisms in graphical password schemes for the benefit of service providers and end-users.

Adaptive user authentication policies are moving in the center of attention lately aiming to assist users in creating memorable and secure passwords. Focusing on graphical user authentication, state-of-the-art research has provided evidence that image-related attributes affect password memorability and security. Nonetheless, the effects of users' contemporary cultural-related memories towards password memorability and security have not been investigated so far, although it is known that user authentication is a cross-cultural task. Aiming to shed light on whether such effects exist, we conducted a study in which users created a graphical password with a contemporary culture-intensive vs. a culture-neutral image. Results indicate that image content related to one's cultural-related memories affects the interaction behavior during password composition, and consequently password memorability. Findings point towards a promising new direction for considering human contemporary cultural memories in the design of adaptive password policies to increase memorability and preserve security.

Recent research provides evidence that individual differences in human cognitive styles affect user performance and experience in diverse application domains. However, state-of-the-art elicitation methods of cognitive styles require researchers to apply explicit, in-lab, and time-consuming "paper-and-pencil" techniques, rendering real-time integration of cognitive styles? elicitation impractical in interactive system design. Aiming to elaborate an implicit elicitation method of cognitive styles, this paper reports two feasibility studies based on an eye-tracking multifactorial model. In both studies, participants performed visual activities of varying characteristics, and the eye-tracking analysis revealed quantitative differences on visual behavior among individuals with different cognitive styles. Based on these differences, a series of classification experiments were conducted, and the results revealed that gaze-based implicit elicitation of cognitive styles in real-time is feasible, which could be used by interactive systems to adapt to the users' cognitive needs and preferences, to better assist them, and improve their performance and experience.

This paper investigates the trade-off between security and usability in recognition-based graphical authentication mechanisms. Through a user study (N=103) based on a real usage scenario, it draws insights about the security strength and memorability of a chosen password with respect to the amount of images presented to users during sign-up. In particular, it reveals the users' predisposition in following predictable patterns when selecting graphical passwords, and its effect on practical security strength. It also demonstrates that a "sweet-spot" exists between security and usability in graphical authentication approaches on the basis of adjusting accordingly the image grid size presented to users when creating passwords. The results of the study can be leveraged by researchers and practitioners engaged in designing intelligent graphical authentication user interfaces for striking an appropriate balance between security and usability.

An effective user authentication mechanism should embrace both security and usability aspects as its purpose is to ensure safety of operation of online services but as well usability and transparency to its end users. In an attempt to improve the usability and overall experience of user interactions during authentication, this paper proposes an alternative approach of personalizing user authentication tasks based on individual differences in cognitive processing. The presented approach is mainly driven by theories on individual differences in cognitive styles which argue that individuals recall and process textual and graphical information differently. In this realm, the paper presents a 4-month user study in which 153 participants interacted with a personalized user authentication mechanism in an ecological valid context. Analysis of results shows that the presented user authentication approach is a promising alternative to current state of user authentication practices.

Stimulated by a large number of different theories on human cognition, suggesting that individuals have different habitual approaches in retrieving, recalling, processing and storing verbal and graphical information, this paper investigates the effect of such processes with regard to user performance and preference toward two variations of knowledge-based authentication mechanisms. In particular, a text-based password authentication mechanism and a recognition-based graphical authentication mechanism were deployed in the frame of an ecological valid user study, to investigate the effect of specific cognitive factors of users toward efficiency, effectiveness and preference of authentication tasks. A total of 145 users participated during a five-month period between February and June 2012. This recent study provides interesting insights for the design and deployment of adaptive authentication mechanisms based on cognitive factors of users. The results and implications of this paper are valuable in understanding and modeling user interactions with regard to authentication mechanisms.

This paper presents the conceptual and architectural design of a multilayered framework aiming to provide a two handed gesture based visual interactive 3D object oriented environment for software development. We argue that this is a viable, intuitive and attractive approach for software development facilitating natural human computer interaction, thus supporting tasks related to software development in a more effective and efficient way. We illustrate the value of the proposed environment through a data analysis from early evaluations of one prototype system in use. The results and implications of this study are useful for designing effective and efficient gesture based 3D interactive software development environments.

A "Completely Automated Public Turing test to tell Computers and Humans Apart" (CAPTCHA) is a mechanism widely used nowadays for protection of web applications, interfaces, and services from malicious users. A questionnaire-based survey combined with a real usage scenario of a native-language CAPTCHA mechanism was conducted in order to investigate several aspects that affect end-user perceptions related to the quality of CAPTCHA. A total of 210 participants of age between 19 and 64 participated during May and July 2010. The survey results validate the common belief that CAPTCHAs are still difficult for humans to solve. They also provide insights that can be applied to improve users' experience on interacting with CAPTCHA systems.