Counting clicks and beeps: Exploring numerosity based haptic and audio PIN entry

Analysis and Improvement on a Unimodal Haptic PIN-Entry Method

“…Recently, Bianchi et al proposed three authentication methods, Spinlock, Colorlock, and Timelock, which are based on a simple counting mechanism [19]. Although the proposal in [19] provides both variants, that is, audio and haptic versions, the above simple counting mechanism is effective, in particular, for the haptic mode. The methods in [19] adopt a novel unimodal approach.…”

“…Although the proposal in [19] provides both variants, that is, audio and haptic versions, the above simple counting mechanism is effective, in particular, for the haptic mode. The methods in [19] adopt a novel unimodal approach. That is, they depend only on vibration cues and do not use any visual cues [19].…”

“…The methods in [19] adopt a novel unimodal approach. That is, they depend only on vibration cues and do not use any visual cues [19]. They are based on the finding in cognitive science that users engaged in nontrivial cognitive tasks perform worse when asked to split their focus over multiple sensory channels [20].…”

“…They are based on the finding in cognitive science that users engaged in nontrivial cognitive tasks perform worse when asked to split their focus over multiple sensory channels [20]. Roughly speaking, the main concept of [19] is to ask users to simply count the number of times that nonvisual cues (vibrations) occur while keeping his/her finger on a button. When the user releases the button, the number of vibrations accumulated up to that point is recognized as the user's PIN digit.…”

“…On the other hand, a response, that is, the time during which a user's finger stays on the button, may be revealed to the attacker. In [19], it was claimed that a proper randomization would reduce the correlation between a PIN and its entry time, keeping the counting-based approach secure against observation attacks. This claim was supported by an attack experiment involving three human attackers, but no numerical evidence was given about the exact level of security guaranteed by the proposed mechanism.…”