Shoulder surfing prevention or mitigation for unlocking mobile devices

Question

How can shoulder surfing be prevented or mitigated when unlocking mobile devices?

I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much more serious and worrying for mobile devices. You carry them around all the time, you are unlocking them in front of other people all the time, the input method for gestures/pins/passwords is slower and leaks a lot of info in several ways (from visual touch feedback to grease marks, etc). I find it way too easy to steal unlock codes (especially gestures and pins), all it usually takes is standing next to somebody when they are about to unlock the screen.

As far as I know, Android supports gestures (ridiculously insecure), pins (still very insecure), and passwords (more secure but also more cumbersome to type). I don't know if anything else is possible, or if there are any settings or methods to mitigate this threat.

Answer 1

To make shoulder surfing for lockscreen pins harder, especially on mobile, I think you're going to have to do something that is not static - that is the content or challenge changes every attempt.

For example, Blackberry used to offer a pseudorandomly generated lockscreen called picture password. It involved you picking some visual element on the picture and dragging that part over a number pad which was randomized every time. This made it so that the pin itself wasn't useful, rather the gestures to unlock them were which makes this more resilient to shoulder surfing.

Another method might be to randomize your keypad for PIN entry. Some custom Android ROMs already offer this. So a shoulder surfer who only sees the pattern that your fingers punch down won't be able to unlock your device by replicating your finger movements.

Other than these two options, other methods might be to use Biometric scanning like Facial recognition or Fingerprint readers. Both of these make it harder for someone to see tour actual pin and unlock your device. Alternatively consider using a paired device with Google's Smart Lock to unlock your device in front of others.