The phone lock

Abstract

Tangible user interfaces are portals to digital information. In the future, securing access to such material will be an important concern. This paper describes the design, implementation and evaluation of a PIN entry system based on audio or haptic cues that is suitable for integration into such physical systems. The current implementation links movements on a mobile phone touch screen with the display of non-visual cues; selection of a sequence of these cues composes a password. Studies reveal the validity of this approach in terms of task times and error rates that improve over prior art. In sum, this paper demonstrates the potential of non-visual PINs as a mechanism for securing access to a range of systems, ultimately incorporating mobile, ubiquitous or tangible interfaces.

Understanding Shoulder Surfing in the Wild

“…As established authentication methods like Android unlock patterns [46] and text-based input [37] are very easy to observe, most prior work focused on investigating and proposing alternative authentication concepts which conceal the entered secret and make the authentication process observation-resistant. A literature review indicates that improved observation-resistance is usually achieved by visual overload (e.g., [18,45,40]), indirect input (e.g., [12,49]), multiplexed input (e.g., [35,44]) or by establishing a second, non-observable, communication channel (e.g., [4,11,26,36,51]). That is, the presentation style or interaction concept are usually modified in a way that makes the input harder to observe.…”

They are all after you

“…In future work, it would be interesting to evaluate other schemes such as XSide [7], SwiPIN [13], PhoneLock [3], SpinLock [4], TimeLock [5] and Colorlock [5] against this threat model. Another interesting direction for future work is to investigate combined threat models.…”

“…Similarly, being multimodal schemes, GazeTouchPass [9] and GazeTouchPIN [11] require attackers to observe the user's eyes to eavesdrop the gaze input, and the phone's screen to find the touch input. Schemes such as SwiPIN [13], PhoneLock [3], SpinLock [4], TimeLock [5] and Colorlock [5] rely on users responding to visual, haptic, or auditory cues. Hhence attackers would need to observe both the output cues in addition to the user's input in response to these cues.…”

A simple PIN input technique resisting shoulder surfing and smudge attacks

“…In the PIN authentication methods, since they are not secure from the shoulder-surfing attacks, the recording attacks, and the smudge attacks, recently some PIN input techniques [1][2][3][4][5][6][7] have been proposed using non-visual channel such as sound channel or vibration channel to resist those attacks. We introduce a PIN input method, The Phone Lock [7], proposed by Bianchi et al as the related research of ours. The method of Bianchi et al is estimated one of the outstanding methods which use sound cues or tactile cues [11].…”

“…To countermeasure shoulder-surfing attacks, recording attacks, and smudge attacks, various PIN input techniques [1][2][3][4][5][6][7][8][9][10] are proposed. This paper proposes a new simple PIN input technique (SPIT) that resists effectively those attacks.…”