Hacker News Reader

Comment by axelfontaine | Hacker News Reader

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction.

The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article.

It is a bit of a usability trade-off though as you can't enter a pin using muscle memory alone anymore, as you must first understand the current keypad layout.

View on HN

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies, 5(2), 2010.

https://uxpajournal.org/usability-evaluation-of-randomized-k...

Thanks! That's indeed interesting.

What I was hoping somebody would study is the ability of practiced thieves to get the PIN under both circumstances. But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.

One quibble I have with the study is that they used novel PINs. I know I'm much faster when typing my real PIN than an arbitrary one. So I suspect the time penalty for random digit layout is larger than they show here.

> But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.

I wouldn't say certainly.

There's more time to observe each keystroke but you have to know what the keystroke is. I've deduced people's 4 digit pin, by accident, from an angle where I can barely see their screen. Randomizing the keypad prevents this.

I think it would only make shoulder-surfing easier if the shoulder-surfer was willing to make what they were doing more apparent.

Also if this was widespread, which I suppose it never will be, people would become used to the randomized keyboard and probably be able to do it a lot quicker.

What are Novel PINs? Some kind of OTP? (I already saw dynamic CVVs but that's stored on the card)

This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.

I believe scrambling should work the best if you scramble the keypad for every digit entered, rather than for the whole of them at once. Otherwise at least the same key presses should be immediately recognisable?

I heard about a device that had fewer keys say 5 only, one for each finger, but to use it you had to insert your hand into a slot in the machine so it’s completely invisible from the outside what keys you’re pressing. Presumably in theory they could use one slot for each hand to get to the full 10 digit range.

Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen).

Edit: Added more context.

When would you have a keylogger and not a screen logger?

Trezor has a separate screen... that screen has your numbers, your computer screen has a blank grid of 3x3. You look at the Trezor and press the correct number in the blank grid.

Hardware-based keyloggers come to mind (especially the kind that MITMs the keyboard cord).

I remember when Runescape added that to opening your bank account. Perhaps it was to deter bots, but also to stop any key/mouse loggers from giving away your secrets.

randomizing the position is also great to prevent people from reading the fingerprints on the screen. after the oleophobic coating has worn off, it's really easy to hand somebody a freshly-cleaned screen and see where their four finger presses were when they hand it back.

For me it is great way to never remember any pin, I heavily rely on muscle memory for pins.

What devices do you have with a dedicated pin pad? Your safe?

When I was in Barcelona an ATM had its keypad numbers flipped (7 8 9; 4 5 6; 1 2 3), which I only realized after the first attempt. Second attempt I got my PIN wrong, and I did not dare to try it a third (and final) attempt. Apparently it's really muscle memory.

Could this have been a skimmer on top of the legit keypad, or is 10-key (vs phone) layout standard in Spain?

You could shrink the keypad and randomly place it on the screen. Or independently change the width and height of the columns and rows of buttons. Or combine the two. This would make it harder to guess the PIN from the accelerometer and you could still use your muscle memory. Designers would have a fit though.

Edit: though on reflection, this might make no difference. Knowing the relative locations of the key presses is probably enough.

You could move and zoom the keyboard after every key press

Perhaps randomly changing the layout? Sometimes the keys are presented in a circular format, another in a figure-8, zigzag, odd numbers at the top of the screen, even at the bottom, etc.

Another tactic might be to have randomized extra keys that show up in a different color or position that aren't a part of the actual PIN but that must all be pressed, in any order, to intermix in the sequence as the the real PIN is entered in proper order. The extra numbers obfuscate the real PIN.

Say, the real PIN is 18145 but 4 extra keys in a distinct color or motif are presented so that the key presses might be 1-8 (real) 8-4 (false) 1-4 (real) 3-6 (false) 5 (real) but the false keys are different each time. It wouldn't matter what order the false keys are pressed or when in the sequence they are pressed as they are ignored by the real PIN mechanism.

... or, some numbers in the PIN require being pressed some random number of times until the key graphically indicates it is accepted. 1-8-1-4-5 might need to be entered as 1-1-8-1-4-4-4-5-5 with the repeat number differing each time.

Or the PIN pad can be presented with a random requirement to slide between 2 or 3 sequential digits rather than lift and tap. Tap-1-Slide-8-1-4-Tap-5.

A few years ago, ANZ Bank offered such a device that they called FastPay. It connected to their mobile phone POS app and helped randomized the PIN entry on the app. Here's their marketing demonstration on it https://youtu.be/I27-B36SaAg?t=80

I'm not sure if it was so much to defend against this type of attack as it was to ensure that no software could intercept taps on the screen and derive your PIN. I believe that the part of PCI rules that cover PIN entry led to this implementation, since this is a mobile POS app running on a potentially hostile device. Typically, POS vendors build dedicated hardware for PIN entry because it's much easier to lock down a system that they have full control over, and thus comply with PCI rules.

(For what it's worth, PCI now has rules on software-based PIN entry on mobile phones.)

Anyone who played runescape 15 years ago can tell you about how annoying this is.

Both LineageOS and GrapheneOS have this feature, it was extremely useful in the past, until FBE (File Based Encryption) took over from FDE (Full Disk Encryption).

You can't separate the lockscreen password and the startup password anymore, so we lost the usability of unlocking using a shorter scrambled PIN but still retaining a longer passphrase for FDE when the device was powered off.

None of this was ever a supported thing, it had to be manually done using `vdc` frontend to `vold` but it was a nice feature.

There's a potential secondary usability trade-off. I only know my PIN by the pattern it makes on the keys. I don't actually have the numbers memorized, just the positional order on a standard keypad layout. So if the numbers are randomized, I would have a really hard time.

That's sort of a feature, because it forces you to adopt a strategy that prevents this type of exploit.

It's also a hell of annoying. Since in 99% of the cases noone is looking over your shoulder it's OK to not give me a puzzle every time.

Also, with consistent numpad I'm able to enter all digits super-quick which is very hard to track. While with randomized numpad I need 5 seconds to find my numbers.

Reminds me of Runescape bank PINs... :)

Reminds me of the Hirsch Scramblepad.

https://www.identiv.com/products/physical-access/readers/hir...

Sounds like an accessibility disaster for people with marginal vision.

Couldn't this also be solved using a piece of plastic that shields view of the keypad to people not standing directly over it?

At least one bank in France (Credit Agricole) also randomizes the placement of numbers on virtual PIN pads on their e-banking website and mobile app.

I’ve also seen it with another bank (BNP Paribas), which is pretty good on phones but annoying on website, since it breaks my password manager. They load images with numbers but I can’t spot any obvious pattern in the requests (which is probably a good design).

Yep, BNP have been doing this for well over a decade for their online banking. They also do it on their mobile banking app.

https://www.swhouse.com/products/readers_Schlage_Scramble_Ke...

This is a not very uncommon type of keypad used for high security facilities, where you may need to scan a proximity card and then enter a PIN.

I had this feature enabled on my old phone, on which I had flashed LineageOS. Unfortunately the new phone's stock ROM doesn't have that, but it also features a fingerprint sensor, so I don't really type my passcode that frequently anymore.

I have found that when I try to enter a password on my phone that I have previously only used on a computer, I sometimes have retained nothing but muscle memory which doesn't translate from keyboard to touchscreen.

My French bank uses this as well (on desktop), and the numbers can’t be typed they have to be clicked on. I think it’s not common enough but a good security feature against attack vectors we don’t reall think about

This is the one feature I miss from CyanogenMod!

Yeah a number of Android versions provided this a few years ago. I guess it was removed because metrics showed it wasn't used? https://android.stackexchange.com/questions/27746/where-to-f...

I had not realised it was in Android proper, I have only seen it in Cyanogenmod. I wonder if it wasn't used more because people didn't know about it, and didn't realise how much safer it was. Sad that they removed it.

Reply on news.ycombinator.com