How to fend off shoulder surfing

@article{citeulike:1373864, abstract = {Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim's account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods. The result support the hypothesis that our primary mechanism strikes a balance between security and usability that is of practical value. In this article, we give a detailed account of our mechanisms and their evaluation.}, author = {Roth, Volker and Richter, Kai }, booktitle = {Frontiers in Payment and Settlement Systems}, citeulike-article-id = {1373864}, journal = {Journal of Banking \& Finance}, keywords = {authentication, password, usability}, month = {June}, number = {6}, pages = {1727--1751}, posted-at = {2007-06-09 05:24:50}, priority = {2}, title = {How to fend off shoulder surfing}, url = {http://www.sciencedirect.com/science/article/B6VCY-4HG675J-1/2/48155e75007390abc2c1385e794a7e87}, volume = {30}, year = {2006} }

TY - JOUR ID - citeulike:1373864 L3 - citeulike-article-id:1373864 TI - How to fend off shoulder surfing T2 - Frontiers in Payment and Settlement Systems JF - Journal of Banking & Finance VL - 30 IS - 6 SP - 1727 EP - 1751 N2 - Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim's account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods. The result support the hypothesis that our primary mechanism strikes a balance between security and usability that is of practical value. In this article, we give a detailed account of our mechanisms and their evaluation. KW - authentication KW - password KW - usability AU - Roth, Volker AU - Richter, Kai PY - 2006/06// UR - http://www.sciencedirect.com/science/article/B6VCY-4HG675J-1/2/48155e75007390abc2c1385e794a7e87 ER -