Evaluating the Usability and Security of Input Masking Techniques

Abstract

The human remains the weakest link in computer security, and one popular method of breaching security is shoulder surfing: looking at a user’s screen or keyboard as he or she enters sensitive input. Various masking techniques exist to hide text from shoulder surfers; the most common of these replaces entered text with bullets. Existing research focuses on how to improve the shoulder surfing resistance of bulletmasking, at a heavy cost to usability. We developed Purloin: an input masking technique designed to maintain the same level of security while increasing usability. We recruited pairs of participants (filling both user and shoulder surfer roles) and tested five different masking techniques on objective measures of usability and security, subjective measures of usability and workload, and user preference. We found that Purloin performed near the top in both usability and security and received the highest overall preference ranking. Bullet-masking was equally secure but less usable. The other masking t...