6 ms·
I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tra
by ydnaclementine 7y ago
I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.
- fbnlsr 7y agoMore importantly, Android's pattern draw allows the user to pass on an already traced line. That way you can't guess the pattern just by looking at the screen smudges.
- psychometry 7y agoSorry, I don't understand what you're trying to say. Why can't you guess the pattern by looking at the smudges?
- alasano 7y agoYou can pass over the same point more than once which would obfuscate the direction of the original passes on the smudge.
- q_eng_anon 7y agoquick somebody do the combinatorics on this
- psychometry 7y agoThe number of unique paths is theoretically infinite since the path could be infinitely long, but there's obviously some software limitation on that.
- ok_coo 7y agoBecause the pattern can go back over part of the screen that's already smudged.
- onion2k 7y agoA valid pattern on Android is to swipe the middle 3 dots backwards and forwards 3 times like left-middle-right-middle-left-middle-right. The smudge on the screen just shows it uses the middle three dots some number of times.
- moviuro 7y agoNot on Android 9 (tested on my Nokia 7 Plus). Once you pass on a dot, you can't get back to it. You also can't "jump over" dots (top left - top right is actually top left - top - top right).
- Karunamon 7y agoThey changed that at some point. Back in the KitKat days, I once pranked a friend by changing their pattern to the same pattern as before, but by skipping the middle dot (top left -> bottom right). If you did it fast enough, the gesture looked identical to the old pattern.
- hanniabu 7y agoIs there a reason why the numbers aren't scrambled? This way you at least wouldn't be able to tell the password unless you saw the actual numbers.
- gambiting 7y agoI can't imagine a more annoying feature. My bank already does this where I cannot use the keyboard to type in digits, I have to use their own on-screen keyboard that's scrambled between every digit(!!!) and I can't imagine anything like that anywhere near my phone. Either pin-based protection is good enough for you, or if you need more security then switch to full a-Z password.
- moviuro 7y agoBank's security relies on reports of the past decade/century, and also, that kind of setup can't be okay for the blind users... how the hell are they supposed to interact with this monstruosity?...
- deleted 7y ago[deleted]
- Beldin 7y agoIt protects against several forms of banking malware trying to steal your money. Of course, i know this because this is old stuff - at least around here. Both protections and banking malware advanced significantly since .. oh, say 2010. But since banking malware is typically focused on countries, it might be different (less obsolete) if you're not in NW Europe.
- bszupnick 7y agoImagine how inconvenient that would be i.e. how much "phone engagement" would take a hit.
- hanniabu 7y ago
- mrlala 7y agoSomehow I doubt this in practice still though.. my wife turned hers on, and it's the most obvious pattern you would think of. And honestly I set it to the same, just because it's the most convenient to use. If I make a convoluted pattern I won't be able to do it as easily. So still same old crap.. we tend to go to thinks we can remember and easily do- and that is not the most secure.
- drivers99 7y ago> it's the most obvious pattern you would think of. First initial probably. > honestly I set it to the same Hmm. If it's the same, last name then? Maybe a diamond or something. I heard (Mitnick's book about best practices called The Art of Invisibility, chapter 1) many people don't use the corner dots very often, or they use an initial of their name. I unintentionally can see people's phone patterns when they do it in view. At least with a passcode you can usually try to ignore it, or you have to try to pay attention. Those pattern ones show it visually in a way that's hard to ignore.
- kevin_thibedeau 7y agoI did too until a few months ago that my pattern lock stopped working and I had to do a factory restore.
- smashface 7y agoI prefer to use the draw password but honestly if you look at the finger smudges on my phone, you could probably still guess my pattern.
- r1ch 7y agoI once got a friend's iPhone passcode correct first try by looking at finger smudges. If you're entering a passcode frequently it's definitely a risk to be aware of.
- chucksmash 7y agoYep, pretty easy to do - especially if your pattern is recognizable or doesn't cross over itself. "Oh hey, cool, a Σ!"
- piotrkubisa 7y agoI liked BlackBerry10 picture passwords [0][1]. Unlocking was a bit slower than drawing few lines but good enough to unlock device fast - I'd say even if you were weakened by some disease/illness/exhausting workout moving slowly a number to target is easier than drawing few crossed lines. [0]: https://helpblog.blackberry.com/2014/02/how-to-use-picture-password-in-blackberry-10-os-version-10-2-1 https://helpblog.blackberry.com/2014/02/how-to-use-picture-p... [1]: https://youtu.be/WmBhvn9Q9SE?t=151 https://youtu.be/WmBhvn9Q9SE?t=151
- Roark66 7y agoWell, if you had a flir camera looking over your shoulder the tracing effect (caused by localised heating of the screen) would still be there. I actually heard it is a legit method to defeat pin entry systems. If you can get to the terminal soon enough it was used, relevant keys will be a little hotter than the other. This will be visible with flir. Then all you have to do is figure out the order of digits.
- Someone1234 7y agoIf you have any camera (FLIR or otherwise) "looking over your shoulder" the method of secret entry is irrelevant.
- 1023bytes 7y agoYou can often see these very obvious smudges on the screen
- piotrkubisa 7y agoThis, 1000x this! The whole "draw your code" is equal to 111111 codes, because both operations are easily possible to hack if you leave your phone to your peer or random freak. Isn't it the same issue as in many house alarm systems that you just need some UV light to note the most used keys to guess the code?
- 99052882514569 7y agoThere are lots of obvious smudges on my screen, and the ones I made first thing after picking up my phone never stand out.