Given the nature of mobile devices and unlock procedures, unlock authentication is a prime target for credential leaking via shoulder sur ng, a form of an observation a ack. While the research community has investigated solutions to minimize or prevent the threat of shoulder sur ng, our understanding of how the a ack performs on current systems is less well studied. In this paper, we describe a large online experiment (n = 1173) that works towards establishing a baseline of shoulder sur ng vulnerability for current unlock authentication systems. Using controlled video recordings of a victim entering in a set of 4-and 6-length PINs and Android unlock pa erns on di erent phones from di erent angles, we asked participants to act as a ackers, trying to determine the authentication input based on the observation. We nd that 6-digit PINs are the most elusive a acking surface where a single observation leads to just 10.8% successful a acks (26.5% with multiple observations). As a comparison, 6-length Android pa erns, with one observation, were found to have an a ack rate of 64.2% (79.9% with multiple observations). Removing feedback lines for pa erns improves security to 35.3% (52.1% with multiple observations). is evidence, as well as other results related to hand position, phone size, and observation angle, suggests the best and worst case scenarios related to shoulder sur ng vulnerability which can both help inform users to improve their security choices, as well as establish baselines for researchers. CCS CONCEPTS•Security and privacy → Graphical / visual passwords; Social aspects of security and privacy;

In this paper, we describe a novel approach to measure the susceptibility of smartphone unlock authentication to shoulder surfing attacks. In our methodology, participants play the role of attackers, viewing video-recorded footage of PIN and graphical password pattern authentication input with various camera angles, hand positions, phone sizes, and authentication length and strength. Based on the data collected and recording methodology developed, we aim to provide insight into the factors of mobile unlock authentication which best and least resist shoulder surfing attacks and examine scenarios where weaknesses may occur. The goal is to identify more effective guidance for mobile device users to avoid observational attacks. We also aim to advance the methodologies used to measure the shoulder surfing attack surfaces where baselines of comparisons to preexisting systems (e.g., PINs and patterns) are not standardized. Utilizing the methodology and recordings, other researchers may build upon this approach to analyze future systems and replicate our results.