English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Given the nature of mobile devices and unlock procedures, unlockauthentication is a prime target for credential leaking via shoulder surfing, aform of an observation attack. While the research community has investigatedsolutions to minimize or prevent the threat of shoulder surfing, ourunderstanding of how the attack performs on current systems is less wellstudied. In this paper, we describe a large online experiment (n=1173) thatworks towards establishing a baseline of shoulder surfing vulnerability forcurrent unlock authentication systems. Using controlled video recordings of avictim entering in a set of 4- and 6-length PINs and Android unlock patterns ondifferent phones from different angles, we asked participants to act asattackers, trying to determine the authentication input based on theobservation. We find that 6-digit PINs are the most elusive attacking surfacewhere a single observation leads to just 10.8% successful attacks, improving to26.5\% with multiple observations. As a comparison, 6-length Android patterns,with one observation, suffered 64.2% attack rate and 79.9% with multipleobservations. Removing feedback lines for patterns improves security from35.3\% and 52.1\% for single and multiple observations, respectively. Thisevidence, as well as other results related to hand position, phone size, andobservation angle, suggests the best and worst case scenarios related toshoulder surfing vulnerability which can both help inform users to improvetheir security choices, as well as establish baselines for researchers.

Towards Baselines for Shoulder Surfing on Mobile Authentication