Photo-based authentication using social networks

We present Lineup, a system that uses the social network graph in Facebook and auxiliary information (e.g., "tagged" user photos) to build a photo-based Web site authentication framework. Lineup's underlying mechanism leverages the concept of CAPTCHAs, programs that are designed to distinguish bots from human users. Lineup extends this functionality to help a Web site ascertain a user's identity or membership in a certain group (e.g., an interest group, invitees to a certain event) in order to infer some level of trust. Lineup works by presenting a user with photographs and asking the user to identify subjects in the photo whom a user with the appropriate identity or group membership should know. We present the design and implementation for Lineup, describe a preliminary prototype implementation, and discuss Lineup's security properties, including possible guarantees and threats.