1

How can shoulder surfing be prevented or mitigated when unlocking mobile devices?

I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much more serious and worrying for mobile devices. You carry them around all the time, you are unlocking them in front of other people all the time, the input method for gestures/pins/passwords is slower and leaks a lot of info in several ways (from visual touch feedback to grease marks, etc). I find it way too easy to steal unlock codes (especially gestures and pins), all it usually takes is standing next to somebody when they are about to unlock the screen.

As far as I know, Android supports gestures (ridiculously insecure), pins (still very insecure), and passwords (more secure but also more cumbersome to type). I don't know if anything else is possible, or if there are any settings or methods to mitigate this threat.

|improve this question
  • 1
    uh, what about fingerprints? – schroeder♦ May 22 '18 at 13:20
  • Gestures can be done while the device is still in your pocket/purse/bag/etc. – schroeder♦ May 22 '18 at 13:23
  • Shouldn't they be called patterns? (Not a native speaker) – toom May 22 '18 at 13:28
  • Apple devices now have Face ID, and Android also has face unlock and voice unlock. Also, PINs aren't very insecure if they are long enough and input is rate limited. There are ways around that, but PINs can be as long as you want. – multithr3at3d May 22 '18 at 13:46
  • face recognition? – elsadek May 22 '18 at 16:22
1

To make shoulder surfing for lockscreen pins harder, especially on mobile, I think you're going to have to do something that is not static - that is the content or challenge changes every attempt.

For example, Blackberry used to offer a pseudorandomly generated lockscreen called picture password. It involved you picking some visual element on the picture and dragging that part over a number pad which was randomized every time. This made it so that the pin itself wasn't useful, rather the gestures to unlock them were which makes this more resilient to shoulder surfing.

Another method might be to randomize your keypad for PIN entry. Some custom Android ROMs already offer this. So a shoulder surfer who only sees the pattern that your fingers punch down won't be able to unlock your device by replicating your finger movements.

Other than these two options, other methods might be to use Biometric scanning like Facial recognition or Fingerprint readers. Both of these make it harder for someone to see tour actual pin and unlock your device. Alternatively consider using a paired device with Google's Smart Lock to unlock your device in front of others.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.