Hacker News Reader

Comment by ydnaclementine | Hacker News Reader

I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.

View on HN

Well, if you had a flir camera looking over your shoulder the tracing effect (caused by localised heating of the screen) would still be there. I actually heard it is a legit method to defeat pin entry systems. If you can get to the terminal soon enough it was used, relevant keys will be a little hotter than the other. This will be visible with flir. Then all you have to do is figure out the order of digits.

If you have any camera (FLIR or otherwise) "looking over your shoulder" the method of secret entry is irrelevant.

You can often see these very obvious smudges on the screen

This, 1000x this! The whole "draw your code" is equal to 111111 codes, because both operations are easily possible to hack if you leave your phone to your peer or random freak. Isn't it the same issue as in many house alarm systems that you just need some UV light to note the most used keys to guess the code?

There are lots of obvious smudges on my screen, and the ones I made first thing after picking up my phone never stand out.

Is there a reason why the numbers aren't scrambled? This way you at least wouldn't be able to tell the password unless you saw the actual numbers.

I can't imagine a more annoying feature. My bank already does this where I cannot use the keyboard to type in digits, I have to use their own on-screen keyboard that's scrambled between every digit(!!!) and I can't imagine anything like that anywhere near my phone. Either pin-based protection is good enough for you, or if you need more security then switch to full a-Z password.

Bank's security relies on reports of the past decade/century, and also, that kind of setup can't be okay for the blind users... how the hell are they supposed to interact with this monstruosity?...

It protects against several forms of banking malware trying to steal your money.

Of course, i know this because this is old stuff - at least around here. Both protections and banking malware advanced significantly since .. oh, say 2010.

But since banking malware is typically focused on countries, it might be different (less obsolete) if you're not in NW Europe.

Imagine how inconvenient that would be i.e. how much "phone engagement" would take a hit.

It can be an opt in setting. But you can make this argument about having a password in the first place.

It's an absolute pain in the ass for the user, especially something you're going to be asked to enter multiple times an hour potentially. I play a game that has a 'bank pin' and they scramble the location of the digits and it slows you down a lot and makes you look and think about it every time you enter it. It's a pain and I only have to enter it after 10 minutes of inactivity.

That would screw me over. My passphrases tend to be based on a physical pattern of the keys. I can't actually tell you what my phone code is. I just know the order I push the buttons. Similarly, if I have to type me computer passphrase on a non-qwerty keyboard, I couldn't do it. I don't actually know the letters, I just know the pattern on the keyboard.

If the numbers were scrambled, I'd have to pick a new system to select a password.

I had an android variant with this feature once.

More importantly, Android's pattern draw allows the user to pass on an already traced line. That way you can't guess the pattern just by looking at the screen smudges.

Sorry, I don't understand what you're trying to say. Why can't you guess the pattern by looking at the smudges?

You can pass over the same point more than once which would obfuscate the direction of the original passes on the smudge.

quick somebody do the combinatorics on this

The number of unique paths is theoretically infinite since the path could be infinitely long, but there's obviously some software limitation on that.

Because the pattern can go back over part of the screen that's already smudged.

A valid pattern on Android is to swipe the middle 3 dots backwards and forwards 3 times like left-middle-right-middle-left-middle-right. The smudge on the screen just shows it uses the middle three dots some number of times.

Not on Android 9 (tested on my Nokia 7 Plus). Once you pass on a dot, you can't get back to it. You also can't "jump over" dots (top left - top right is actually top left - top - top right).

They changed that at some point. Back in the KitKat days, I once pranked a friend by changing their pattern to the same pattern as before, but by skipping the middle dot (top left -> bottom right). If you did it fast enough, the gesture looked identical to the old pattern.

I prefer to use the draw password but honestly if you look at the finger smudges on my phone, you could probably still guess my pattern.

I once got a friend's iPhone passcode correct first try by looking at finger smudges. If you're entering a passcode frequently it's definitely a risk to be aware of.

Yep, pretty easy to do - especially if your pattern is recognizable or doesn't cross over itself.

"Oh hey, cool, a Σ!"

I liked BlackBerry10 picture passwords [0][1]. Unlocking was a bit slower than drawing few lines but good enough to unlock device fast - I'd say even if you were weakened by some disease/illness/exhausting workout moving slowly a number to target is easier than drawing few crossed lines.

[0]: https://helpblog.blackberry.com/2014/02/how-to-use-picture-p...

[1]: https://youtu.be/WmBhvn9Q9SE?t=151

Somehow I doubt this in practice still though.. my wife turned hers on, and it's the most obvious pattern you would think of.

And honestly I set it to the same, just because it's the most convenient to use. If I make a convoluted pattern I won't be able to do it as easily.

So still same old crap.. we tend to go to thinks we can remember and easily do- and that is not the most secure.

> it's the most obvious pattern you would think of.

First initial probably.

> honestly I set it to the same

Hmm. If it's the same, last name then? Maybe a diamond or something. I heard (Mitnick's book about best practices called The Art of Invisibility, chapter 1) many people don't use the corner dots very often, or they use an initial of their name.

I unintentionally can see people's phone patterns when they do it in view. At least with a passcode you can usually try to ignore it, or you have to try to pay attention. Those pattern ones show it visually in a way that's hard to ignore.

I did too until a few months ago that my pattern lock stopped working and I had to do a factory restore.

Reply on news.ycombinator.com