Spinlock: A Single-Cue Haptic and Audio PIN Input Technique for Authentication

Abstract

Authentication in public spaces is inherently exposed to observation attacks in which passwords are stolen by the simple act of watching the data input process. Addressing this issue are systems that secure authentication input via PINs or passwords that rely on sets of relatively unobservable tactile or audio cues. However, although secure, such systems typically invoke high levels of cognitive load in their users which is instantiated in lengthy authentication times and high error rates and most likely due to significant cognitive demands in terms of processing, mapping or recalling non visual information. To address this issue this paper introduces Spinlock, a novel authentication technique based on repeated presentation, recognition and enumeration of a single, simple invisible cue (audio or haptic), rather than a set of structured stimuli. This approach maintains the security but avoids the complexity of previous systems. A prototype illustrating this concept is described as well as a study comparing modalities and gauging overall levels of performance, usability and security. The results show that authentication with Spinlock is faster and less error prone than previous non-visual systems, while maintaining a similar security level. Limitations and future work are discussed.