AlignPIN: Indirect PIN Selection For Protection Against Repeated Shoulder Surfing

Abstract

Authentication schemes need to be designed such that they can provide security against observational attacks. Many modern day services use Personal Identification Numbers (PINs) to authenticate their users. However, conventional PIN interfaces provide minimal to no security against observational attacks such as shoulder surfing. We propose AlignPIN, an Indirect PIN selection technique which is resistant to shoulder surfing. We present a detailed analysis to show that AlignPIN is effective in providing resistance against not only casual shoulder surfing, but also sophisticated shoulder surfing and repeated shoulder surfing. To test the usability of AlignPIN, we present a comprehensive usability analysis through data collected over the course of a twelve day usability study done with both young and old participants. The combined results of the security analysis and the practical usability study show that AlignPIN can be used as a PIN selection technique in public places.