Article

A PIN-entry method resilient against shoulder surfing

Authors:

Rene FreidingerAuthors Info & Claims

CCS '04: Proceedings of the 11th ACM conference on Computer and communications security

Pages 236 - 245

https://doi.org/10.1145/1030083.1030116

Published: 25 October 2004 Publication History

Abstract

Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim's account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods, the results of which we also present in the paper.

References

[1]

http://www.swiveltechnologies.com, July 2004.]]

[2]

http://www.hirschelectronics.com/Products_ScramblePads.asp, July 2004.]]

[3]

Passfaces. www.realuser.com, Apr. 2004.]]

[4]

ANDERSON, R. Why cryptosystems fail. In Proc. 1st ACM Computers and Communications Security Conference (Fairfax, Virginia, USA, Nov. 1993).]]

Digital Library

[5]

BALFANZ, D. Usable access control for the world wide web. In Proc. Nineteenth Annual Computer Security Applications Conference (Dec. 2003), IEEE, pp. 406--415.]]

Digital Library

[6]

BRADER, M. Shoulder-surfing automated. Risks Digest 19.70, Apr. 1998.]]

[7]

BRIER, E., NACCACHE, D., AND PAILLIER, P. Chemical combinatorial attacks on keyboards. International Association for Cryptographic Research ePrint Archive 2003, 217 (2003).]]

[8]

BROOKE, J. SUS: A quick and dirty usability scale. In Usability evaluation in industry, P. Jordan, B. Thomas, B. Weerdmeester, and I. McClelland, Eds. Taylor and Francis, London, 1996, pp. 189--194.]]

[9]

COLVILLE, J. Atm scam netted $620,000 australian. Risks Digest 22.85, Aug. 2003.]]

[10]

COUNT ZERO. Card-o-rama: Magnetic stripe technology and beyond. Phrack, 37 (1992).]]

[11]

DHAMIJA, R., AND PERRIG, A. Déjà vu: A user study using images for authentication. In Proc. 9th USENIX Security Symposium (Denver, CO, USA, Aug. 2000).]]

Digital Library

[12]

DOURISH, P., AND REDMILES, D. An approach to usable security based on event monitoring and visualization. In Proc. New Security Paradigms Workshop (Virginia Beach, VA, USA, Sept. 2002), ACM, pp. 75--81.]]

Digital Library

[13]

HOPPER, N. J., AND BLUM, M. A secure human-computer authentication scheme. Technical Report CMU-CS-00-139, School of Computer Science, Carnegie Mellon University, Pittsburgh, PA, May 2000.]]

[14]

HOPPER, N. J., AND BLUM, M. Secure human identification protocols. In ASIACRYPT (2001), C. Boyd, Ed., vol. 2249 of Lecture Notes in Computer Science, Springer Verlag, pp. 52--66.]]

Digital Library

[15]

INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. Banking - Personal Identification Number (PIN) management and security - Part 1: Basic principles and requirements for online PIN handling in ATM and POS systems, May 2002. TC 68/SC 6.]]

[16]

KUHN, M. Probability theory for pickpockets - ec-PIN guessing. Available at http://www.cl.cam.ac.uk/~mgk25/, 1997.]]

[17]

LI, X.-Y., AND TENG, S.-H. Practical human-machine identification over insecure channels. Journal of Combinatorial Optimization 3, 4 (1999).]]

[18]

MATSUMOTO, T., AND IMAI, H. Human identification through insecure channel. In EUROCRYPT (1991), D. W. Davies, Ed., vol. 547 of Lecture Notes in Computer Science, Springer Verlag, pp. 409--421.]]

[19]

MILLER, G. A. The magical number seven, plus or minus two: Some limits on our capacity for processing information. Psychological Review 63 (1956), 81--97.]]

[20]

MOLLER, B. Schwachen des ec-PIN-Verfahrens. Available at http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller, Feb. 1997. Manuscript.]]

[21]

MURDOCK, B. B. The retention of individual items. Journal of of Experimental Psychology 62 (1961), 618--625.]]

[22]

PATRICK, A., LONG, C., AND (ORGANIZERS), S. F. Workshop on human-computer interaction and security systems at acm chi 2003. Web pages at URL http://www.andrewpatrick.ca/CHI2003/HCISEC/index.html, Apr. 2003.]]

Digital Library

[23]

PERTERSON, L. R., AND PETERSON, M. J. Short-term retention of individual verbal items. Journal of of Experimental Psychology, 58 (1959), 193--198.]]

[24]

PLATH, H.-E., AND RICHTER, P. Ermüdungs-Monotonie-Sättigung-Stress (BMS). Tech. rep., Psychodiagnostisches Zentrum, Dresden, Germany, 1984.]]

[25]

SASSE, M. A. Computer security: Anatomy of a usability, and a plan for recovery. {22}.]]

[26]

SMETTERS, D. K., AND GRINTER, R. E. Moving from the design of usable security technologies to the design of useful secure applications. In Proceedings of the New Security Paradigms Workshop (Virginia Beach, VA, USA, Sept. 2002), ACM, pp. 82--89.]]

Digital Library

[27]

SMITH, S. L. Authenticating users by word association. Computers & Security 6 (1987), 464--470.]]

Digital Library

[28]

SPECTOR, Y., AND GINZBERG, J. Pass-sentence - a new approach to computer code. Computers & Security 13 (1994), 145--160.]]

Digital Library

[29]

STIRZAKER, D. Elementary Probability, 2nd ed. Cambridge University Press, 2003.]]

[30]

SUMMERS, C., AND TOYNE, S. Gangs preying on cash machines. BBC News Online, Oct. 2003.]]

[31]

TOM MARKOTTEN, D. G. User-centered security engineering. In Proc. 4th NordU Conference (Helsinki, Finland, Feb. 2002).]]

[32]

VOGEL, E. K., AND MACHIZAWA, M. G. Neural activity predicts individual differences in visual working memory capacity. Nature 428 (Apr. 2004), 748--751.]]

[33]

WEINSTOCK, C. Atm fraud. Risks Digest 4.86, May 1987.]]

[34]

WHITTEN, A., AND TYGAR, J. D. Why Johnny can't encrypt: A usability evaluation of PGP 5.0. In Proc. 9th USENIX Security Symposium (August 1999).]]

Digital Library

[35]

WILFONG, G. T. Method and apparatus for secure PIN entry. US Patent #5,940,511, United States Patent and Trademark Office, May 1997. Assignee: Lucent Technologies, Inc. (Murray Hill, NJ).]]

[36]

WOOD, D. Spain uncovers hi-tech cashpoint fraud. BBC News Online, Jan. 2003.]]

[37]

YEE, K.-P. User interaction design for secure systems. In Proc. 4th International Conference on Information and Communications Security (Singapore, Dec. 2002), R. Deng, S. Qing, F. Bao, and J. Zhou, Eds., vol. 2513 of Lecture Notes in Computer Science, Springer Verlag, pp. 278--290. ISBN 3-540-00164-6.]]

Digital Library

[38]

ZVIRAN, M., AND HAGA, W. J. Cognitive passwords: The key to easy access control. Computers & Security 9 (1990), 723--736.]]

Digital Library

Cited By

Lee JKim IOh SKim H(2025)TaPIN: Reinforcing PIN Authentication on Smartphones With Tap BiometricsIEEE Transactions on Mobile Computing10.1109/TMC.2024.350290224:4(2519-2533)Online publication date: Apr-2025
https://doi.org/10.1109/TMC.2024.3502902
Ahmad AAsif MHamid IAljuaid H(2025)PassNum: A usable and secure method against repeated shoulder surfingBehaviour & Information Technology10.1080/0144929X.2025.2469665(1-27)Online publication date: 4-Mar-2025
https://doi.org/10.1080/0144929X.2025.2469665
Corbett MDavid-John BShang JJi B(2024)ShouldAR: Detecting Shoulder Surfing Attacks Using Multimodal Eye Tracking and Augmented RealityProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36785738:3(1-23)Online publication date: 9-Sep-2024
https://dl.acm.org/doi/10.1145/3678573
Show More Cited By

Recommendations

Understanding Shoulder Surfing in the Wild: Stories from Users and Observers
CHI '17: Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems

Research has brought forth a variety of authentication systems to mitigate observation attacks. However, there is little work about shoulder surfing situations in the real world. We present the results of a user survey (N=174) in which we investigate ...
Evaluating Attack and Defense Strategies for Smartphone PIN Shoulder Surfing
CHI '18: Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems

We evaluate the efficacy of shoulder surfing defenses for PIN-based authentication systems. We find tilting the device away from the observer, a widely adopted defense strategy, provides limited protection. We also evaluate a recently proposed defense ...
Reducing shoulder-surfing by using gaze-based password entry
SOUPS '07: Proceedings of the 3rd symposium on Usable privacy and security

Shoulder-surfing -- using direct observation techniques, such as looking over someone's shoulder, to get passwords, PINs and other sensitive personal information -- is a problem that has been difficult to overcome. When a user enters information using a ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CCS '04: Proceedings of the 11th ACM conference on Computer and communications security

October 2004

376 pages

ISBN:1581139616

DOI:10.1145/1030083

General Chair:
Vijay Atluri
Rutgers University
,
Program Chairs:
Birgit Pfitzmann
IBM Research, Switzerland
,
Patrick McDaniel
AT&T Labs

Copyright © 2004 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 October 2004

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

CCS04

Sponsor:

CCS04: 11th ACM Conference on Computer and Communications Security 2004

October 25 - 29, 2004

Washington DC, USA

Acceptance Rates

Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

Upcoming Conference

CCS '25

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 13 - 17, 2025

Taipei , Taiwan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

176
Total Citations
View Citations
2,160
Total Downloads

Downloads (Last 12 months)49
Downloads (Last 6 weeks)3

Reflects downloads up to 05 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Lee JKim IOh SKim H(2025)TaPIN: Reinforcing PIN Authentication on Smartphones With Tap BiometricsIEEE Transactions on Mobile Computing10.1109/TMC.2024.350290224:4(2519-2533)Online publication date: Apr-2025
https://doi.org/10.1109/TMC.2024.3502902
Ahmad AAsif MHamid IAljuaid H(2025)PassNum: A usable and secure method against repeated shoulder surfingBehaviour & Information Technology10.1080/0144929X.2025.2469665(1-27)Online publication date: 4-Mar-2025
https://doi.org/10.1080/0144929X.2025.2469665
Corbett MDavid-John BShang JJi B(2024)ShouldAR: Detecting Shoulder Surfing Attacks Using Multimodal Eye Tracking and Augmented RealityProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36785738:3(1-23)Online publication date: 9-Sep-2024
https://dl.acm.org/doi/10.1145/3678573
Sathya KEsther JKavitha SKamalakumari J(2024)Facetpass- Intelligent Facial Recognition Authentication System Security and Usability2024 2nd International Conference on Artificial Intelligence and Machine Learning Applications Theme: Healthcare and Internet of Things (AIMLA)10.1109/AIMLA59606.2024.10531549(1-6)Online publication date: 15-Mar-2024
https://doi.org/10.1109/AIMLA59606.2024.10531549
Yang ZKong J(2024)Cue-based two factor authenticationComputers and Security10.1016/j.cose.2024.104068146:COnline publication date: 1-Nov-2024
https://dl.acm.org/doi/10.1016/j.cose.2024.104068
Zhou MWang QLin XZhao YJiang PLi QShen CWang C(2023)PressPIN: Enabling Secure PIN Authentication on Mobile Devices via Structure-Borne SoundsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2022.315188920:2(1228-1242)Online publication date: 1-Mar-2023
https://doi.org/10.1109/TDSC.2022.3151889
Binbeshr FPor LKiah MZaidan AImam M(2023)Secure PIN-Entry Method Using One-Time PIN (OTP)IEEE Access10.1109/ACCESS.2023.324311411(18121-18133)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3243114
Wang JGao BTu HLiang HLiu ZLuo WWeng J(2023)Secure and Memorable Authentication Using Dynamic Combinations of 3D Objects in Virtual RealityInternational Journal of Human–Computer Interaction10.1080/10447318.2023.221760840:17(4608-4626)Online publication date: 12-Jun-2023
https://doi.org/10.1080/10447318.2023.2217608
Bostan HBostan A(2023)Shoulder surfing resistant graphical password schema: Randomized Pass Points (RPP)Multimedia Tools and Applications10.1007/s11042-023-15227-x82:28(43517-43541)Online publication date: 15-Apr-2023
https://doi.org/10.1007/s11042-023-15227-x
Kirkwood DTombul CFirth CMacdonald FPriftis KMathis FKhamis MMarky K(2022)PIN Scrambler: Assessing the Impact of Randomized Layouts on the Usability and Security of PINsProceedings of the 21st International Conference on Mobile and Ubiquitous Multimedia10.1145/3568444.3568450(83-88)Online publication date: 27-Nov-2022
https://dl.acm.org/doi/10.1145/3568444.3568450
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten