💻 computer science

Pick and Sort for Graphical Authentication

The paper proposes a configurable "Pick and Sort" graphical authentication scheme where users select and arrange visual elements in a grid, which, despite longer login times, offers an easy-to-learn and flexible solution suitable for infrequent access or secondary authentication scenarios.

Original authors: Argianto Rahartomo, AmirHossein Jamshidipoor, Mohammad Ghafari

Published 2026-05-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Argianto Rahartomo, AmirHossein Jamshidipoor, Mohammad Ghafari

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you're trying to unlock a secret treasure chest. Usually, you have to remember a long, complicated code like "P@ssw0rd123!" or a specific pattern you drew on a phone screen. But what if, instead of typing or drawing, you could just pick your favorite toys and arrange them in a specific way on a game board?

That is exactly what the researchers in this paper are proposing. They call their new security system "Pick and Sort."

Here is how it works, broken down into simple concepts:

The Game Board (The Grid)

Think of the login screen as a small tic-tac-toe board (a grid). In their test, they used a 4x4 grid, which is like a slightly bigger tic-tac-toe board with 16 empty squares.

The Pieces (The Visual Elements)

Instead of letters or numbers, you have a "bag" of pictures to choose from. The researchers provided three different bags:

Colors (like a big box of crayons).
Icons (like emojis: fire, water drops, money bags).
Shapes (circles, squares, triangles).

How You "Log In"

Pick: You look through the bags and choose a few items you like. Maybe you pick a "Black Circle," a "Fire" icon, and a "Red" crayon.
Sort: You place these items onto the grid. You decide where they go. Maybe the fire goes in the top-left corner, the circle in the middle, and the red crayon in the bottom-right.
The Secret: Your password isn't just the items you picked; it's the items plus their exact positions on the board.

Why This is Different (The "Magic" Trick)

Most password systems rely on you remembering a sequence (like "A, then B, then C"). This system mixes two things:

Recognition: You don't have to remember what the items are from scratch; you just have to recognize them when you see them (like spotting your favorite toy in a pile).
Recall: You do have to remember where you put them on the board.

The researchers found that this is like a game. It's easier for your brain to remember "I put the fire in the top corner" than it is to remember a random string of letters.

What Happened When They Tested It

The researchers built a prototype and asked 59 people (including kids and adults) to try it out. Here is what they discovered:

It's a bit slower: Typing a password is fast. Picking pictures and placing them takes a little longer (about 20–30 seconds). The researchers admit this isn't great if you are in a huge rush, but it's fine if you are logging in once a day or once a week.
People get better with practice: The first time people tried to log in, they made mistakes. But after a few tries, even a month later, they got faster and more accurate. It's like learning a new card game; the first time is confusing, but soon it becomes muscle memory.
People have "favorite" moves: Just like in a game, people tended to pick the same popular items (like the color Black or the Fire icon) and put them in the same easy-to-remember spots (like the top row). This is a bit risky because a hacker might guess those popular spots first.
It's flexible: You can change the game. If you are a child, you could use cartoon characters. If you are an older adult, you could use bigger, clearer icons. The system adapts to you.

The Bottom Line

The researchers aren't trying to replace your phone's fingerprint scanner or your bank's passkey. Instead, they are offering a backup plan or a specialized tool.

Think of it like a safety deposit box that is a bit slower to open than your front door, but much harder for a burglar to guess because they have to know exactly which pictures you chose and where you hid them on the board. It's a secure, visual way to prove who you are, especially for people who find typing passwords difficult or for situations where you don't need to log in every single minute.

In short: It turns a boring, stressful password into a simple, visual puzzle that is easy to learn but hard for strangers to guess.

1. Problem Statement

Traditional text-based authentication (passwords, PINs) suffers from poor memorability, susceptibility to guessing/phishing, and user fatigue. While modern alternatives like Passkeys (WebAuthn) and biometrics offer improvements, they have significant limitations:

Passkeys: Tied to specific devices or ecosystems; recovery is difficult if a device is lost or replaced.
Biometrics: Cannot function as a standalone web authentication mechanism without coordinated support from hardware, OS, and browsers; biometric data cannot be reset if compromised.
Existing Graphical Passwords: Often suffer from low entropy (users pick obvious images), are limited to single-device scenarios, rely on complex gestures, or depend on specific visual hotspots that are easy to guess.

The authors aim to bridge the gap between security (high entropy, resistance to guessing) and usability (low cognitive load, game-like interaction) for scenarios where login speed is not critical (e.g., infrequent access or secondary authentication).

2. Methodology: The "Pick and Sort" Scheme

The authors propose a hybrid graphical authentication scheme combining recognition and recall mechanisms.

Core Workflow

Registration: Users select a set of visual elements from categorized pools (e.g., colors, icons, shapes) and arrange them into a specific spatial configuration within a grid (e.g., 4×4).
Authentication: Users must recognize their chosen elements and place them in the exact same grid positions.
Randomization: To prevent position-based guessing, the prototype randomizes the display order of the element pools during every login attempt, forcing the user to actively search for their specific items rather than relying on muscle memory of fixed locations.

Key Design Characteristics

Hybrid Mechanism:
- Recognition: Users identify their chosen images from a pool (reducing memory load).
- Recall: Users must remember the specific spatial arrangement (increasing entropy).
Configurability: The grid size ( $n$ ) and the number of selected elements ( $k$ ) are adjustable. The system supports disjoint sets of elements ( $m$ sets).
Order Independence: The secret is defined by the final configuration of elements, not the order in which they were clicked, reducing cognitive burden.
Entropy Calculation: The theoretical password space is calculated using the inclusion-exclusion principle to account for disjoint sets and grid permutations. The formula accounts for selecting $k$ elements from $m$ sets into an $n \times n$ grid.

Prototype Implementation

Tech Stack: HTML/CSS/JS (Frontend), Django (Backend), SQLite (Database).
Element Sets: Three curated sets: Colors (40 items), Icons (90 items), Shapes (50 items).
Constraints: Users must select at least one element from each set and arrange them in a 4×4 grid.

3. Key Contributions

Novel Scheme Design: Introduction of "Pick and Sort," a platform-independent, grid-based graphical authentication method that balances recognition and recall.
Theoretical Framework: A mathematical formulation for calculating the theoretical entropy of the scheme based on grid size, element selection, and set constraints.
Empirical User Study: A preliminary study with 82 participants (including minors) evaluating the scheme's usability, memorability, and security characteristics.
Security Analysis: Quantitative analysis of the scheme's resistance to guessing attacks using empirical Shannon entropy and guessability metrics (work factor).

4. Results

The study involved 82 participants, with 59 completing the first login stage and 43 completing all three stages (Registration, Day 1, Day 10, Day 28).

Usability & Performance

Registration Time: Average ~50 seconds. Younger users (<20) were faster than older groups.
Login Time: Average ~22 seconds (successful attempts). This is slower than text-based methods but consistent across stages.
Success Rate:
- Stage 1 (Day 1): 58% success rate.
- Subsequent Stages (Day 10/28): Improved to 74%.
- Observation: Success rates improve with practice, and the scheme remains memorable even after a 28-day gap.
Retention: 72.88% of participants completed all phases.

Security & Entropy

Element Selection: Users typically selected 3–5 elements. "Black" was the most frequent color choice.
Pattern Bias: Users favored simple, reproducible patterns:
- Horizontal Lines: 23 occurrences.
- L-shapes: 19 occurrences.
- Diagonals: 9 occurrences.
- Complex patterns (squares) were rare.
Empirical Entropy:
- Total unique secrets observed: 59.
- Shannon Entropy: 5.85 bits (approaching the theoretical maximum for the sample size).
- Guessability: An attacker guessing the most common secrets first would need:
  - 5 guesses to compromise 10% of accounts.
  - 29 guesses to compromise 50% of accounts.
- Note: While the theoretical entropy is high (~120 bits), the actual entropy is limited by user bias toward simple patterns.

5. Significance and Limitations

Significance

Accessibility: The scheme is highly suitable for specific demographics (e.g., children, elderly) who may find text passwords difficult but can engage with the "game-like" visual interface.
Complementary Role: It is not intended to replace Passkeys or biometrics but serves as a robust fallback or secondary authentication method for browser-based environments where advanced hardware support is unavailable.
Deployability: Requires no specialized hardware; works on any device with a touch or click interface.

Limitations & Threats to Validity

Internal Validity: Participants used their own devices remotely, introducing variability in screen sizes and input methods. No post-study satisfaction surveys were conducted.
External Validity: The sample was drawn from university networks and personal connections, potentially lacking demographic diversity.
Security Gaps: The study did not simulate real-world adversarial attacks (e.g., shoulder surfing). The observed preference for simple patterns (lines, L-shapes) suggests that without guidance, users may reduce the effective entropy.
Missing Features: The prototype lacked a "Forgot Password" mechanism, preventing the measurement of False Rejection Rates (FRR) and False Acceptance Rates (FAR).

Conclusion

"Pick and Sort" demonstrates that a configurable, grid-based graphical authentication scheme can offer a viable balance between security and usability. While login times are longer than conventional methods, the scheme shows promise for infrequent-access scenarios and specific user groups. Future work focuses on refining the interface to discourage simple patterns, expanding element diversity for accessibility, and conducting large-scale longitudinal studies.