  Graphical passwords are implemented as an alternative scheme to replace
alphanumeric passwords to help users to memorize their password. However, most
of the graphical password systems are vulnerable to shoulder-surfing attack due
to the usage of the visual interface. In this research, a method that uses
shifting condition with digraph substitution rules is proposed to address
shoulder-surfing attack problem. The proposed algorithm uses both password
images and decoy images throughout the user authentication procedure to confuse
adversaries from obtaining the password images via direct observation or
watching from a recorded session. The pass-images generated by this suggested
algorithm are random and can only be generated if the algorithm is fully
understood. As a result, adversaries will have no clue to obtain the right
password images to log in. A user study was undertaken to assess the proposed
method's effectiveness to avoid shoulder-surfing attacks. The results of the
user study indicate that the proposed approach can withstand shoulder-surfing
attacks (both direct observation and video recording method).The proposed
method was tested and the results showed that it is able to resist
shoulder-surfing and frequency of occurrence analysis attacks. Moreover, the
experience gained in this research can be pervaded the gap on the realm of
knowledge of the graphical password.
