On Evaluating the Entropy of Graphical Passwords