Discretization is used in click-based graphical passwords so that approximately correct entries can

be accepted by the system. We show that the existing discretization scheme of Birget et al. (2006) allows

for false accepts and false rejects because the tolerance region is not guaranteed to be centered on the

original click-point, causing usability and security concerns. Using empirical data from a large user

study, we show that this is a significant issue in practice. We then introduce Centered Discretization, a

simpler discretization method that eliminates false accepts and false rejects. It also allows for smaller

tolerance regions without impacting the usability of the system.