Privacy Enhancing Keyboard: Design, Implementation, and Usability Testing

Abstract

To protect users from numerous password inference attacks, we invent a novel context aware privacy enhancing keyboard (PEK) for Android touch-based devices. Usually PEK would show a QWERTY keyboard when users input text like an email or a message. Nevertheless, whenever users enter a password in the input box on his or her touch-enabled device, a keyboard will be shown to them with the positions of the characters shuffled at random. PEK has been released on the Google Play since 2014. However, the number of installations has not lived up to our expectation. For the purpose of usable security and privacy, we designed a two-stage usability test and performed two rounds of iterative usability testing in 2016 and 2017 summer with continuous improvements of PEK. The observations from the usability testing are educational: (1) convenience plays a critical role when users select an input method; (2) people think those attacks that PEK prevents are remote from them.

Conducting and Mitigating Portable Thermal Imaging Attacks on User Authentication using AI-driven Methods

“…Prior work has investigated changing authentication interfaces to increase resilience to thermal attacks. For example alternative authentication schemes could be employed, such as biometrics [6], mid-air gestures [11], or using a privacy enhanced keyboard (PEK) [15]. Such solutions would, however, require changing to a wide variety of new and legacy interfaces that are distributed on a societal scale, making them impractical to apply or enforce.…”

Horus: A Security Assessment Framework for Android Crypto Wallets

“…Additionally, the app is vulnerable to user dictionary attack. A wallet app should have a custom keyboard triggered while taking any key revealing input and possibly randomize the keyboard's key location [59].…”