The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.
This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs
Open accessAbstract
We provide the first comprehensive study of user-chosen 4- and 6-digit PINs (n = 1220) collected on smartphones with participants being explicitly primed for device unlocking. We find that against a throttled attacker (with 10, 30, or 100 guesses, matching the smartphone unlock setting), using 6-digit PINs instead of 4-digit PINs provides little to no increase in security, and surprisingly may even decrease security. We also study the effects of blacklists, where a set of "easy to guess" PINs is disallowed during selection. Two such blacklists are in use today by iOS, for 4-digits (274 PINs) as well as 6-digits (2910 PINs). We extracted both blacklists compared them with four other blacklists, including a small 4-digit (27 PINs), a large 4-digit (2740 PINs), and two placebo blacklists for 4- and 6-digit PINs that always excluded the first-choice PIN. We find that relatively small blacklists in use today by iOS offer little or no benefit against a throttled guessing attack. Security gains are only observed when the blacklists are much larger, which in turn comes at the cost of increased user frustration. Our analysis suggests that a blacklist at about 10 % of the PIN space may provide the best balance between usability and security.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Aviv, A. J., Budzitowski, D., & Kuber, R. (2015) · Proceedings of the 31st Annual Computer Security Applications Conference · doi:10.1145/2818000.2818014 · Cited by 68 · cited 4×
“These results have been confirmed by other works [6], [27], [45].”
BackgroundMethodResultInfluentialSelf-citation
Flagged first, then by citations
Research works printed but not linked: 35
- uellenbeck, 2016, Quantifying the Security of Graphical Passwords: The Case of Android Unlock Patterns, ACM Conference on Computer and Communications Security CCS '13, 161
- sunshine, 2009, Crying Wolf: An Empirical Study of SSL Warning Effectiveness, USENIX Security Symposium SSYM '09, 399
- redmiles, 2017, A Summary of Survey Methodology Best Practices for Security and Privacy Researchers, Technical Report CS-TR-5055
- 10.1145/3290605.3300393 · DOI
- stark, 2019, The URLephant, USENIX Enigma Conference Enigma '19
- 10.1145/2702123.2702586 · DOI
- 10.1145/2406367.2406384 · DOI
- 10.1109/WorldCIS.2015.7359406 · DOI
- 10.1145/2858036.2858384 · DOI
- 10.14722/eurousec.2016.23001 · DOI
- mohammad, 2013, Crowdsourcing a Word-Emotion Association Lexicon, Computational Intelligence, 29, 436, 10.1111/j.1467-8640.2012.00460.x · DOI
- akhawe, 2013, Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness, USENIX Security Symposium SSYM '13, 257
- harbach, 2014, It's a Hard Lock Life: A Field Study of Smartphone (Un)Locking Behavior and Risk Perception, SOUPS Symp on Usable Privacy and Security, 213
- 10.1007/978-3-319-07620-1_15 · DOI
- 10.1109/SP.2012.38 · DOI
- 10.1006/obhd.1997.2746 · DOI
- 10.1016/j.cose.2012.02.003 · DOI
- 10.1109/SP.2012.49 · DOI
- 10.1007/978-3-642-32946-3_3 · DOI
- 10.1145/3025453.3026050 · DOI
- cherapau, 2015, On the Impact of Touch ID on iPhone Passcodes, SOUPS Symp on Usable Privacy and Security, 257
- felt, 2015, Improv¬ing SSL Warnings: Comprehension and Adherence, ACM Conference on Human Factors in Computing Systems CHI '15, 2893, 10.1145/2702123.2702442 · DOI
- 10.1145/3243734.3243769 · DOI
- 10.14722/usec.2019.23025 · DOI
- golla, 2018, What was that site doing with my Facebook password?” Designing Password-Reuse Notification, ACM Conference on Computer and Communications Security CCS '18, 1549
- aviv, 2010, Smudge Attacks on Smartphone Touch Screens, 11th USENIX Workshop on Offensive Technologies WOOT, 1
- 10.1145/3134600.3134609 · DOI · Paper page
- yang, 2014, Text Entry Method Affects Password Security, The LASER Workshop Learning from Authoritative Security Experiment Results, 11
- aviv, 2018, Comparing Video Based Shoulder Surfing with Live Simulation and Towards Baselines for Shoulder Surfing on Mobile Authentication, Annual Conference on Computer Security Applications ACSAC '18, 486
- 10.1145/3052973.3053031 · DOI
- zezschwitz, 2016, Sascha Ober¬huber, Alexander De Luca, Florian Alt, and Heinrich Hussmann. On Quantifying the Effective Passsword Space of Grid-Based Unlock Ges¬tures, Conference on Mobile and Ubiquitous Multimedia MUM '16, 201, 10.1145/3012709.3012729 · DOI
- 10.1002/j.2161-1939.2011.tb00103.x · DOI
- ur, 2015, Measuring Real-World Accu-racies and Biases in Modeling Password Guessability, USENIX Security Symposium SSYM '15, 463
- ur, 2015, I Added ‘!' at the End to Make It Secure”: Observing Password Creation in the Lab, SOUPS Symp on Usable Privacy and Security, 123
- 10.1145/2639189.2639218 · DOI
Cited by
Sorted by citations
Evaluating the Security Posture of Real-World FIDO2 Deployments
Kuchhal, D., Saad, M., Oest, A., & Li, F. (2023) · Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3576915.3623063 · Cited by 22
“FIDO defines stringent biometric performance requirements that a FIDO-certified authenticator needs to adhere to [5], while prior work has shown that knowledge-based factors such as PINs can often be observed or easily guessed [66], such as bymalware on the device.”
Background
Metadata
- Authors
- Markert, P., Bailey, D. V., Golla, M., Durmuth, M., & Aviv, A. J.
- Affiliations
- Ruhr University Bochum (DE)
- Max Planck Society (DE)
- George Washington University (US)
- Venue
- 2020 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2020-05
- Pages
- 286-303
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W3015019937
- Cited by
- 9
- References
- 1
- Citations by year
- 2024: 2 · 2021: 3 · 2020: 4
- FWCI
- 1.33
- Type
- conference paper
- Language
- en
- Open access
- green
- doi.org
- Licence
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1845300)
- Australian Government
- Deutsche Forschungsgemeinschaft (390781972)
- Topics
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Keywords
- PIN security, smartphone unlocking, iOS, user frustration
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
