# Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 and not press ↵

What impact does this have on security? Still there is an infinite pool of passwords an attacker has to choose from. Is it much less secure and what is the minimum length of PIN should be? I'm concerned now that I'm starting to use my phone for banking.

Another nifty feature I enabled is to scramble the keypad layout so an attacker can't try to guess based on finger print smudges.

UPDATE: pin must be between 4 and 16 digits (inclusive)

• I've never heard of scrambling keyboard. Nice feature, but I'm afraid many users will choose short passwords as they realize the pain of finding the keys everytime. Commented Jun 3, 2015 at 21:36
• @Manumit these exist in the real world too, for example this one (one example of many on the market). Commented Jun 3, 2015 at 22:51
• For a transaction situation it's BRILLIANT. Commented Jun 3, 2015 at 23:08

## 2 Answers

``````What impact does this have on security?
``````

Your passwords are at worst 89% of the strength they would be if you had to press enter first. Here's how I calculated it. Suppose your password can be either 1-3 digits long, and also suppose an attacker does not know the length of your password. There are 1000 total combinations (0-999). Suppose your password is 7. 111 out of 1000 passwords will pass that test. (One single digit + 10 2 digits + 100 3 digits.) In the worst case that's (1-0.111) = 89% as strong as forcing someone to press enter. If your password is 71, 11 out of 1000 will pass it (99% as strong), and if your password is 711, 1 out of 1000 will pass it (100% as strong). The more digits you add, the further away from 89% you get, and the closer to 100% you get. So, effectively, we could say the security impact of this feature is minimal. The time saved by you in the long run of not having to press enter is probably worth it.

``````Is it much less secure and what is the minimum length of PIN should be?
``````

If you choose a pin length of one more than you would normally choose, you are almost at the same level of security.

``````I'm concerned now that I'm starting to use my phone for banking.
``````

I'm not sure how this is relevant. You should still be using a different password for banking. If you handed your unlocked phone to an attacker, your banking information should still be safe. If that's not true, perhaps because you have passwords remembered by banking sites or apps, then you may want to consider changing that. You cannot guarantee that your phone will be locked when an attacker takes it. (Like if someone running down the street rips it out of your hand.)

It depends on if your phone has a minimum PIN length that is not the same as the maximum PIN length. Consider the case, where the phone permits PINs of 4, 5, or 6 digits, and your PIN is 12345. When you first tap "1234", you're effectively testing a PIN of value "1234". When you then tap "5", you're now testing the PIN value of "12345". By entering all digits, you have actually tested two different PINs.

As an attacker I can type 12340, then backspace and type 1, backspace and type 2, etc. This will test PINs of values 1234, 12340, 12341, 12342 , etc,. all without triggering the "too many tries" flag that might be hit if I entered 6 digits. Your only security recourse in this scheme is to ensure your PIN is exactly the maximum length permitted.

If all PINs must be exactly 5 digits, then it's as secure as any 5 digit random number with a "ten tries and the phone locks" algorithm, meaning there's a 1:1000 chance of the attacker guessing it (if it's truly random.)

• PIN must be between 4 and 16 digits (inclusive). Commented Jun 3, 2015 at 22:03