Abstract
Whenever there is a password required to access a system, the security of this system is measured in part by the strength of the used password. Guessability is a serious security attack that has been widely used to crack passwords in relatively short times. It can take many forms such as brute force (exhaustive search) and dictionary attacks. Generally speaking, the concept has been extensively studied in the context of traditional text-based or alphanumeric passwords. However, as different graphical password schemes start to evolve, there is an urgent need to explore and analyze geussability and other security aspects of this scheme, especially, given that it is regarded a usable solution preferred to users due to their memorability feature. In this paper, we present our empirical findings on the topic after conducting a user study and a post-experiment questionnaire. We also survey the related literature and conclude with some recommendations for further research in the area.