I have a web application that replaces a non-web predecessor.
A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch panels being secured with a PIN code.
The replacement devices panels will be android. We have suggested doing this as a passphrase, or as a numeric input, but product management wants an HTML rendered "key pad" screen instead of the normal android input panel behavior.
Gut feeling is that this is less secure than using the OS inputs, but I cannot come up with a concrete reason that it should be that doesn't also apply in either case.
Am I overlooking something or is my initial reaction incorrect here?