Future authentication systems (IRIS)

Memorizing a different unguessable password for every account is impossible: "Pick something you can't remember, then don't write it down". Pico (short video at http://mypico.org), under development at the University of Cambridge, is a novel system that lets you log in by waving an electronic device at your screen, without remembering any secrets or typing anything. The main problem faced by Pico is deployment: how to convince the major web sites to support it?
The proposed research consists of deploying Pico onto an existing high-traffic web site in the Alexa top 1000, http://gyazo.com, which already has a population of 7 million users, and to learn useful practical lessons from this deployment. These will inform and inspire further development of Pico. The experience gained will make it easier to persuade other existing sites to support Pico alongside passwords.

Between them, the PI and the Fellow have an outstanding track record on impact. The PI is the author of two papers with over 1000 citations and the Fellow is the author of 3 high-usability systems with over a million users.
Insofar as this research is a stepping stone towards universal deployment of Pico, and an enabler for Pico adoption by all the major web sites, the ultimate indirect impact is potentially extremely broad: everyone who must use passwords on the web will benefit from this work. More directly, the research will benefit the webmasters who are considering offering support for Pico but hesitate because they don't want to go first. This project will bridge the gap from theory to practice and will prove to them that the technology is mature. Academically, it will also constructively prove that individual professors can do effective large-scale security usability research involving millions of users (real users, not mturkers or captive undergraduates) without having to beg for the cooperation of the big Internet companies.