Work in Progress: On the In-Accuracy and Influence of Android Pattern Strength Meters

Abstract

A common method for helping users select stronger authentication secrets, e. g., passwords, is to deploy a visual strength meter that provides feedback to the user while performing password selection. Recent work considered the accuracy of strength meters for passwords, but there is limited work on understanding the accuracy of strength meters for other knowledge-based authentication types, particularly Android's graphical pattern unlock, despite there being multiple strength meters proposed for patterns in the literature. In this work, we present a preliminary analysis of the accuracy of strength meters for Android patterns, applying the same set of techniques from previous work. Using datasets of patterns collected in several user studies as a baseline, we compare strength meter estimations using weighted Spearman correlation. Overall, we find that strength estimations based on visual properties of the patterns (such as length, intersections, overlapping nodes, and similar) provide strength estimations that have low correlation with the real guessability of Android patterns. Motivated by these findings, we describe a set of research questions and experiments that are in progress that question whether the accuracy of a meter should even be the driving factor for nudging users to more secure choices.

Double Patterns: A Usable Solution to Increase the Security of Android Unlock Patterns

“…Andriotis et al [2], Sun et al [24], and Song et al [23] each proposed visual based strength metrics and a display meter to boost diversity of patterns selected. While meters may be an effective means of changing behavior, Golla et al demonstrated that strength metrics used in these meters do not correlate with security, and likely, just the presence of the meter changes behavior [15].…”

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

“…To provide more comparison points, we consider a number of other authentication datasets listed in Table I. For example, we use a 3x3 Android unlock pattern dataset described by Golla et al [17], combining four different datasets [6], [27], [39], [45]. It consists of 4637 patterns with 1635 of those being unique.…”

Double Patterns: A Usable Solution to Increase the Security of Android Unlock Patterns

“…Andriotis et al [3], Sun et al [24], and Song et al [23] each proposed visual based strength metrics and a display meter to boost diversity of patterns selected. While meters may be an e ective means of changing behavior, Golla et al demonstrated that strength metrics used in these meters do not correlate with security, and likely, just the presence of the meter changes behavior [15]. Cho et al proposed SysPal [12], which highlights certain contact points that must be used as part of the pattern, restricting users to select di erent patterns but also more diverse ones.…”