Vibration-Aided Picture-Based Authentication for Shoulder-Surfing Resistant Mobile Login

Text and graphical passwords on smartphones are easy to shoulder-surf in public, and many of the alternatives that have been proposed do not work well on small touchscreens. We describe a vibration-aided picture-password scheme that pairs an image-based credential with hidden haptic prompts. The user selects an image during registration, picks at least three secret locations on it, defines a set of deceiving locations, and maps vibration patterns to specific decoy tap styles. The image, locations, vibration mapping, spatial acceptance regions, and timing thresholds are stored on a server. At login time, the server builds a per-session challenge that interleaves the secret and deceiving locations, assigns vibration patterns only to the decoys, and pushes the challenge to the client. The device displays the image, vibrates before each decoy tap, and records tap coordinates and durations. The server matches the input against the challenge, accepts or rejects accordingly, and regenerates a fresh challenge after any mismatch, so that replay and pattern-learning attempts gain nothing. Because the vibration cue is tactile and not visible from outside, an onlooker cannot tell a genuine tap from a decoy response. The result is better resistance to shoulder-surfing without any extra hardware and without asking the user to learn anything especially complex.

@article{Albadi2026,
  title     = {Vibration-Aided Picture-Based Authentication for Shoulder-Surfing Resistant Mobile Login},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {6},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Ibrahim Albadi and Mahdi Almalki and Abdullah Albokhari and Salman Alsumairi and Sami Atiyah and Faisal Alsubaei and Abdullah Abuhussein},
  doi       = {10.14569/IJACSA.2026.0170617},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170617}
}