Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.
posted by martyb on Wednesday September 27 2017, @11:48AM   Printer-friendly
from the I-saw-what-you-did-there dept.

As reported by Techtimes, When it comes to unlocking your Android phone, Patterns are out and Pins are back in.

The full study: Towards Baselines for Shoulder Surfing on Mobile Authentication (PDF) (open, DOI: 10.1145/3134600.3134609) (DX) was conducted by the Naval Academy and University of Maryland.

Security researchers at the U.S. Naval Academy, together with the University of Maryland Baltimore County, published a study showing how a casual onlooker can visually memorize a person's pattern then recreate it with ease. In the tests, they found that two out of three people were able to recreate six-point unlock patterns purely by looking at them from 5 or 6 feet away.

[...] Those same conditions were then replicated with a more traditional six-digit PIN code, which proved far more difficult, with only one out of 10 observers able to recreate the PIN code after peeking.

With multiple chances to view your pattern or pin, the ability of an observer to unlock your phone grows:

In the online tests, 64 percent were able to recreate the Android-style pattern after merely one viewing, but that shot up to 80 percent after a second viewing. PIN codes, meanwhile, rendered much lower vulnerability percentages: only 11 percent were able to identify a six-digit PIN after viewing it once, and 27 percent after viewing it twice.

Apple's new FaceID, previously covered Here on SN and explained more fully on Techcrunch's extensive article has its own problems and annoyances, as well as the fear of being grabbed by police, cuffed, and your phone being held in front of your face before you have time to hit 5 button presses it takes to shut off FaceID. The phone is too new for any independent tests to have been run using pictures or movies of your face.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by kazzie on Wednesday September 27 2017, @03:29PM (3 children)

    by kazzie (5309) Subscriber Badge on Wednesday September 27 2017, @03:29PM (#573840)

    When trying to interpret your numbers, I was confused by the fact you have ten starting digits per length. After some insight I realised they correspond to a point layout of:

    1 2 3
    4 5 6
    7 8 9
      0

    but I thought that these patterns were all based on a 3x3 grid, like so:

    1 2 3
    4 5 6
    7 8 9

    Is this right? I've never owned an Android phone, so I can't speak from experience.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by frojack on Wednesday September 27 2017, @07:23PM (1 child)

    by frojack (1554) on Wednesday September 27 2017, @07:23PM (#573968) Journal

    That's about right.

    The thing about patterns is that not all starting positions have the name number of NEXT numbers.
    Start in a corner, there are three possible next numbers.
    Start in the center, there are 8.

    It mis actually possible to use a disjoint pattern, (drawing around the edges and in-between the columns/rows on your way to the next dot), but most people don't do this just due to the increased chance of fat-fingering the pattern. (Which might make it a better choice for a less surf-able pattern).

    --
    No, you are mistaken. I've always had this sig.
    • (Score: 0) by Anonymous Coward on Thursday September 28 2017, @06:46PM

      by Anonymous Coward on Thursday September 28 2017, @06:46PM (#574477)

      Yeah it's possible to use disjoint patterns - you can also use two fingers to tap them to make it easy to not fat finger (e.g. do a zig zag skipping the middle 1 3 4 6 7 9) . But most people won't do such stuff, and so there aren't that many very long nondisjoint/"easy disjoint" patterns. And picking those might not be the best strategy ;).

  • (Score: 2) by FatPhil on Wednesday September 27 2017, @09:32PM

    by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday September 27 2017, @09:32PM (#574050) Homepage
    I did all the calculations on a 3x3, and then just before posting I thought "shit, I've forgotten the 0", as I realised I was letting PINs use "0", but swipes not, thought that was unfair, and decided to redo them. I've never had a phone with such a lock, and if 0's aren't allowed, then of course the entropy values will be lower.
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves