TwoStep: An Authentication Method Combining Text and Graphical Passwords

Text-based passwords alone are subject to dictionary attacks as users tend to choose weak passwords ill favor of memorability, as well as phishing attacks. Many recognition-based graphical password schemes alone, in order to offer sufficient security, require a number of rounds of verification, introducing usability issues. We suggest a hybrid user authentication approach combining text passwords, recognition-based graphical passwords, and a two-step process, to provide increased security with fewer rounds than Such graphical passwords alone. A variation of this two-step authentication method, which we have implemented and deployed, is in use ill the real world.