A PIN-entry method resilient against shoulder surfing

By Volker Roth, Kai Richter, Rene Freidinger. Conference on Computer and Communications Security, 2004

337 citations recorded by the source corpus.

Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim's account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods, the results of which we also present in the paper.

Subfields: Cognitive Neuroscience, Information Systems, Social Psychology

View Paper: https://www.semanticscholar.org/paper/ed6e02e85ce9d410467fb795abdb2ebbe837ef1f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Cognitive Neuroscience

1. Nasir D. Memon
2. Susan Wiedenbeck
3. Jean-Camille Birget
4. Furkan Tari
5. A. Ant Ozok
6. Jim Waters
7. Stephen H. Holden

In Information Systems

1. P. V. Oorschot
2. Robert Biddle
3. Sonia Chiasson
4. Nasir D. Memon
5. Susan Wiedenbeck
6. Jean-Camille Birget
7. Furkan Tari
8. A. Ant Ozok

In Social Psychology

1. Sonia Chiasson
2. Furkan Tari
3. A. Ant Ozok
4. Stephen H. Holden
5. Joseph Bonneau

Citations in the corpus

• Graphical passwords: Learning from the first twelve years (2012, background): “Shoulder surfing [Tari et al. 2006; Roth et al. 2004; Backes et al. 2008; Laxton et al. 2008] is a targeted attack exacerbated by the visual aspect of graphical passwords.”
• A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords (2006, methodology): “In another study, researchers proposed a method, which they referred to as “cognitive trapdoor games” that offers increased security for users entering their PIN numbers even if an attacker fully observes the entry [33].”
• Biometric-rich gestures: a novel approach to authentication on multi-touch devices (2012, methodology): “In 2004, Roth et al [19] proposed a PIN-based challenge response approach.”
• Design and evaluation of a shoulder-surfing resistant graphical password scheme (2006, background): “Roth and his colleagues [15] have developed a scheme to protect numeric PIN-entry systems against shoulder-surfing.”