GTmoPass: two-factor authentication on public displays using gaze-touch passwords and personal mobile devices
Now you see me, now you don't: protecting smartphone authentication from shoulder surfers