The Interplay between Personal Relationships & Shoulder Surfing Mitigation

Abstract

Shoulder surfing refers to observing someone's device screen without their consent. Conspicuously switching off the screen upon noticing a friend observing private messages may create an embarrassing situation. Initial evidence indicates that users adopt strategies to mitigate shoulder surfing based on their relationship to the observer. However, the social implications of such mitigation strategies remain largely unexplored. We present findings from an interview study with 12 participants to address this. We analyze experiences with shoulder surfers of different relationships to the user and collect feedback on eleven state-of-the-arts strategies for mitigating shoulder surfing. We show that the user-observer relationship impacts the choice of mitigation methods and that users often do not want observers to know they were caught. Based on our results, we conclude with implications for designing socially acceptable privacy protection mechanisms on mobile devices. CCS Concepts: • Security and privacy → Human and societal aspects of security and privacy.

Shoulder Surfing through the Social Lens: A Longitudinal Investigation & Insights from an Exploratory Diary Study

“…Alerting mechanisms only alert the user about shoulder surfing and lets the user decide what to do next. Whereas, a mitigation mechanism protects privacy by hiding the content [16].…”

PrivacyScout: Assessing Vulnerability to Shoulder Surfing on Mobile Devices

“…It is important to consider the usability and social implications of consistent warning. Previous work showed that reacting in an overt way to a shoulder surfing situation may damage the relationship between the user and the shoulder surfer [17], who may be friends, family members or partners [15,30]. In fact, a study by Farzand et al [17] showed that users prefer to use cover methods for mitigating shoulder surfing, and invest time and effort in making sure the shoulder surfer does not know that they were caught.…”

“…Previous work showed that reacting in an overt way to a shoulder surfing situation may damage the relationship between the user and the shoulder surfer [17], who may be friends, family members or partners [15,30]. In fact, a study by Farzand et al [17] showed that users prefer to use cover methods for mitigating shoulder surfing, and invest time and effort in making sure the shoulder surfer does not know that they were caught. It is important to note that shoulder surfers are not necessarily the user's enemies; shoulder surfing is in many cases unintentional or done out of boredom rather than being motivated by malicious intentions [15].…”

“…It is important to note that shoulder surfers are not necessarily the user's enemies; shoulder surfing is in many cases unintentional or done out of boredom rather than being motivated by malicious intentions [15]. Some recorded shoulder surfing incidents even involved children shoulder surfing their older siblings or parents out of curiosity rather than malicious intentions [17].…”

Understanding Shoulder Surfer Behavior and Attack Patterns Using Virtual Reality

“…Most notably, researchers have designed approaches to protecting credentials from shoulder surfing, including PINs [15,16,27,37] and textual and graphical passwords [11,26]. Also Farzand et al investigated the personal relations and shoulder surfing mitigation strategies [13]. Again, these countermeasures mostly focus on personal mobile devices, but there is also work on mitigation strategies on other devices like public displays [9,15] and heads-up displays [41].…”