The DOI matches its Crossref record; 27 of the 27 references it cites were found in a registry or an index.
Is Bigger Better? Comparing User-Generated Passwords on 3x3 vs. 4x4 Grid Sizes for Android's Pattern Unlock
Open accessAbstract
Android's graphical authentication mechanism requires users to unlock their devices by "drawing" a pattern that connects a sequence of contact points arranged in a 3x3 grid. Prior studies demonstrated that human-generated 3x3 patterns are weak (CCS'13); large portions can be trivially guessed with sufficient training. An obvious solution would be to increase the grid size to increase the complexity of chosen patterns. In this paper we ask the question: Does increasing the grid size increase the security of human-generated patterns? We conducted two large studies to answer this question, and our analysis shows that for both 3x3 and 4x4 patterns, there is a high incidence of repeated patterns and symmetric pairs (patterns that derive from others based on a sequence of flips and rotations), and many 4x4 patterns are expanded versions of 3x3 patterns. Leveraging this information, we developed an advanced guessing algorithm and used it to quantified the strength of the patterns using the partial guessing entropy. We find that guessing the first 20% (G0.2) of patterns for both 3x3 and 4x4 can be done as efficiently as guessing a random 2-digit PIN. While guessing larger portions of 4x4 patterns (G0.5) requires 2-bits more entropy than guessing the same ratio of 3x3 patterns, it remains on the order of cracking random 3-digit PINs. Of the patterns tested, our guessing algorithm successful cracks 15% of 3x3 patterns within 20 guesses (a typical phone lockout) and 19% of 4x4 patterns within 20 guesses; however, after 50,000 guesses, we correctly guess 95.9% of 3x3 patterns but only 66.7% of 4x4 patterns. While there may be some benefit to expanding the grid size to 4x4, we argue the majority of patterns chosen by users will remain trivially guessable and insecure against broad guessing attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Morris, R., & Thompson, K. (1979) · Communications of the ACM · doi:10.1145/359168.359172 · Cited by 929
The design and analysis of graphical passwords
Jermyn, I. H., Mayer, A. J., Monrose, F., Reiter, M. K., & Rubin, A. D. (1999) · Durham Research Online (Durham University) · Cited by 755
PassPoints: Design and longitudinal evaluation of a graphical password system
Wiedenbeck, S., Waters, J., Birget, J.-C., Brodskiy, A., & Memon, N. D. (2005) · International Journal of Human-Computer Studies · doi:10.1016/j.ijhcs.2005.04.010 · Cited by 691
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.49 · Cited by 690
Analysis of end user security behaviors
Stanton, J. M., Stam, K. R., Mastrangelo, P. M., & Jolton, J. A. (2004) · Computers & Security · doi:10.1016/j.cose.2004.07.001 · Cited by 670
Perception and memory for pictures: Single-trial learning of 2500 visual stimuli
Standing, L., Conezio, J., & Haber, R. N. (1970) · Psychonomic Science · doi:10.3758/bf03337426 · Cited by 664
Smudge attacks on smartphone touch screens
Aviv, A. J., Gibson, K. L., Mossop, E., Blaze, M., & Smith, J. M. (2010) · Cited by 659
Self-citationBiddle, R., Chiasson, S., & van Oorschot, P. C. (2012) · ACM Computing Surveys · doi:10.1145/2333112.2333114 · Cited by 563
Kelley, P. G., Komanduri, S., Mazurek, M. L., Shay, R., Vidas, T. M., Bauer, L., Christin, N., Cranor, L. F., & Lopez, J. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.38 · Cited by 413
Password Security: An Empirical Study
Zviran, M., & Haga, W. J. (1999) · Journal of Management Information Systems · doi:10.1080/07421222.1999.11518226 · Cited by 252
Practicality of accelerometer side channels on smartphones
Aviv, A. J., Sapp, B., Blaze, M., & Smith, J. M. (2012) · Annual Computer Security Applications Conference · doi:10.1145/2420950.2420957 · Cited by 230
Self-citationMeasuring password guessability for an entire university
Mazurek, M. L., Komanduri, S., Vidas, T. M., Bauer, L., Christin, N., Cranor, L. F., Kelley, P. G., Shay, R., & Ur, B. (2013) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2508859.2516726 · Cited by 223
Quantifying the security of graphical passwords
Uellenbeck, S., Dürmuth, M., Wolf, C., & Holz, T. (2013) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2508859.2516700 · Cited by 205
It's a hard lock life: A field study of smartphone (un)locking behavior and risk perception
Harbach, M., von Zezschwitz, E., Fichtner, A., Luca, A. D., & Smith, M. (2014) · Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) · Cited by 199
Pass-Go: A Proposal to Improve the Usability of Graphical Passwords
Hai, T., & Adams, C. M. (2008) · Cited by 196
von Zezschwitz, E., Dunphy, P., & Luca, A. D. (2013) · International Conference on Human-Computer Interaction with Mobile Devices and Services (MobileHCI) · doi:10.1145/2493190.2493231 · Cited by 142
A pilot study on the security of pattern screen-lock methods and soft side channel attacks
Andriotis, P., Tryfonas, T., Oikonomou, G., & Yildiz, C. (2013) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/2462096.2462098 · Cited by 106
Weiss, R., & Luca, A. D. (2008) · Nordic Conference on Human-Computer Interaction · doi:10.1145/1463160.1463202 · Cited by 105
Dissecting pattern unlock: The effect of pattern strength meter on pattern selection
Sun, C., Wang, Y., & Zheng, J. J. (2014) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2014.10.009 · Cited by 79
Easy to Draw, but Hard to Trace?
von Zezschwitz, E., Luca, A. D., Janssen, P., & Hußmann, H. (2015) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/2702123.2702202 · Cited by 67
Complexity Metrics and User Strength Perceptions of the Pattern-Lock Graphical Authentication Method
Andriotis, P., Tryfonas, T., & Oikonomou, G. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-07620-1_11 · Cited by 65
On the Effectiveness of Pattern Lock Strength Meters
Song, Y., Cho, G., Oh, S., Kim, H., & Huh, J. H. (2015) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/2702123.2702365 · Cited by 62
PIN selection policies: Are they really effective?
Kim, H., & Huh, J. H. (2012) · Computers & Security · doi:10.1016/j.cose.2012.02.003 · Cited by 34
Understanding visual perceptions of usability and security of Android's graphical password pattern
Aviv, A. J., & Fichter, D. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664253 · Cited by 29
Self-citationOperating system framed in case of mistaken identity
Bravo-Lillo, C., Cranor, L. F., Downs, J. S., Komanduri, S., Schechter, S., & Sleeper, M. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382237 · Cited by 13
Usability and Security of Gaze-Based Graphical Grid Passwords
Arianezhad, M., Stebila, D., & Mozaffari, B. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-41320-9_2 · Cited by 5
Kessler, G. C. (2013) · The journal of digital forensics, security and law · doi:10.15394/jdfsl.2013.1156 · Cited by 5
Flagged first, then by citations
Cited by
Sorted by citations
Zhou, M., Wang, Q., Yang, J., Li, Q. L., Xiao, F., Wang, Z., & Chen, X. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243777 · Cited by 83
“[9] showed that there is a high incidence of repeated patterns and symmetric pairs for both 3 × 3 and 4 × 4 patterns.”
BackgroundA Video-based Attack for Android Pattern Lock
Ye, G., Tang, Z., Fang, D., Chen, X., Wolff, W., Aviv, A. J., & Wang, Z. (2018) · ACM Transactions on Privacy and Security · doi:10.1145/3230740 · Cited by 57
“We also compared our attack against the guessing based attack presented by Aviv et al. (2015).”
BackgroundMethodResultInfluentialSelf-citationTowards Baselines for Shoulder Surfing on Mobile Authentication
Aviv, A. J., Davin, J. T., Wolf, F., & Kuber, R. (2017) · Maryland Shared Open Access Repository (USMAI Consortium) · doi:10.13016/m2r72d-udi6 · Cited by 57
Self-citationBoosting the Guessing Attack Performance on Android Lock Patterns with Smudge Attacks
Cha, S., Kwag, S., Kim, H., & Huh, J. H. (2017) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3052973.3052989 · Cited by 53
Towards Baselines for Shoulder Surfing on Mobile Authentication
Aviv, A. J., Davin, J. T., Wolf, F., & Kuber, R. (2017) · Proceedings of the 33rd Annual Computer Security Applications Conference · doi:10.1145/3134600.3134609 · Cited by 45
Self-citationSysPal: System-Guided Pattern Locks for Android
Cho, G., Huh, J. H., Cho, J., Oh, S., Song, Y., & Kim, H. (2017) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2017.61 · Cited by 44
“, 4×4) layout [4] have been suggested as a way to help users select stronger patterns.”
BackgroundMethodInfluentialFine-Grained and Context-Aware Behavioral Biometrics for Pattern Lock on Smartphones
Shi, D., Tao, D., Wang, J., Yao, M., Wang, Z., Chen, H., & Helal, S. (2021) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3448080 · Cited by 36
“, 4×4) layout [5] and system-guided scheme [11] all attempt to help users choose stronger patterns to mitigate guessing attacks[30], but the resistance of these solutions to attacks such as shoulder-surfing is limited.”
BackgroundOn the Security of Smartphone Unlock PINs
Markert, P., Bailey, D. V., Golla, M., Dürmuth, M., & Aviv, A. J. (2021) · ACM Transactions on Privacy and Security · doi:10.1145/3473040 · Cited by 34
Self-citationThis PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs
Markert, P., Bailey, D. V., Golla, M., Durmuth, M., & Aviv, A. J. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00100 · Cited by 9
“These results have been confirmed by other works [6], [27], [45].”
BackgroundMethodResultInfluentialSelf-citationStealing Your Android Patterns via Acoustic Signals
Zhou, M., Wang, Q., Yang, J., Li, Q. L., Jiang, P., Chen, Y., & Wang, Z. (2019) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2019.2960778 · Cited by 27
“Aviv et al. [44] showed that there is a high incidence of repeated patterns and symmetric pairs for both 3 (cid”
BackgroundOn User Choice for Android Unlock Patterns
Løge, M. D., Drmuth, M., & Røstad, L. (2016) · European Symposium on Usable Security (EuroUSEC) · doi:10.14722/eurousec.2016.23001 · Cited by 25
“[4], who compared Android Unlock Patterns both on the standard 3 × 3 grid and on a 4 × 4, and found a very limited increase of security on the larger grid.”
BackgroundMethodDouble Patterns: A Usable Solution to Increase the Security of Android Unlock Patterns
Forman, T. J., & Aviv, A. J. (2020) · Annual Computer Security Applications Conference · doi:10.1145/3427228.3427252 · Cited by 21
“investigated 4x4 patterns [4], finding that there are little benefits from larger patterns.”
BackgroundMethodInfluentialSelf-citationCan I Borrow Your ATM? Using Virtual Reality for (Simulated) In Situ Authentication Research
Mathis, F., Vaniea, K. E., & Khamis, M. (2022) · IEEE Conference on Virtual Reality and 3D User Interfaces (VR) · doi:10.1109/vr51125.2022.00049 · Cited by 20
“, interviews [10, 68], online studies [8, 9, 19]), there is a considerable amount of research that still relies on labbased investigations.”
BackgroundUnderstanding Authentication Method Use on Mobile Devices by People with Vision Impairment
Briotto Faustino, D., & Girouard, A. (2018) · Proceedings of the 20th International ACM SIGACCESS Conference on Computers and Accessibility · doi:10.1145/3234695.3236342 · Cited by 19
“Besides from being the most ubiquitous option, PINs are considerably more secure than patterns, as even a 2-digit PIN is most secure than a pattern of dots connected by drawing on the screen, because people tend to create very simple patterns [4].”
BackgroundComparing Video Based Shoulder Surfing with Live Simulation
Aviv, A. J., Wolf, F., & Kuber, R. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274702 · Cited by 18
“The patterns were selected from an online study of self-reported patterns [3], and the PINs were obtained from sequences of digits in leaked password sets, similar to the analysis by Bonneau et al.”
MethodSelf-citationTupsamudre, H., Banahatti, V., Lodha, S., & Vyas, K. (2017) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3052973.3053041 · Cited by 15
“These attacks are more likely to succeed since users choose simple patterns [6, 13] containing only horizontal (1 → 2) or vertical lines (1 → 4) which could be easily memorized by an observer.”
BackgroundMethodResultInfluentialFingerPattern: Securing Pattern Lock via Fingerprint-Dependent Friction Sound
Zhou, M., Zhou, Y., Su, S., Wang, Q., Li, Q. L., Hu, S., Yu, C., & Li, Z. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3338148 · Cited by 13
“Thetraditionalpatternlockisvulnerabletovarioustypesofat-tacks, e.g., guessing attacks [29], [30], smudge attacks [7], [31], shoulder surfing attacks [5], thermal attacks [8], video-assisted attacks [10] and sound-based tracking attacks [11].”
BackgroundAlsuhibany, S. A. (2019) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-019-01269-3 · Cited by 12
“Security and usability are the most important aspects that we have to take into account in the authentication system, which is a challenge in both Human-Computer-Interaction (HCI) and the security community’s areas (Aviv et al. 2015).”
BackgroundMethodInfluentialA new smart smudge attack using CNN
Shin, H., Sim, S., Kwon, H.-Y., Hwang, S., & Lee, Y. (2021) · International Journal of Information Security · doi:10.1007/s10207-021-00540-z · Cited by 12
Bu-Dash: a universal and dynamic graphical password scheme (extended version)
Andriotis, P., Kirby, M., & Takasu, A. (2022) · International Journal of Information Security · doi:10.1007/s10207-022-00642-2 · Cited by 12
TinPal: An Enhanced Interface for Pattern Locks
Tupsamudre, H., Vaddepalli, S., Banahatti, V., & Lodha, S. (2018) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2018.23021 · Cited by 10
“Many research studies [25], [8], [24] show that users’ pattern choices are highly biased and drawn from a small space.”
BackgroundMethodResultInfluentialDoes the layout of the Android unlock pattern affect the security and usability of the password?
Zhang, L., Guo, Y., Guo, X., & Shao, X. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.103011 · Cited by 10
Honeyword-based Authentication Techniques for Protecting Passwords: A Survey
Chakraborty, N., Li, J., Leung, V. C. M., Mondal, S., Pan, Y. F., Luo, C., & Mukherjee, M. (2022) · ACM Computing Surveys · doi:10.1145/3552431 · Cited by 10
“, two-factor authentication (combining any two of the first three factors shown in Figure 1) [32, 52], graphical passwords [4], behaviour biometrics [64], etc.”
BackgroundAnalyzing the Impact of Collection Methods and Demographics for Android's Pattern Unlock
Aviv, A. J., Maguire, J., & Luning-Prak, J. (2016) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2016.23025 · Cited by 9
“This metric has been used previously [3], [10], [7] as a measure of graphical pattern strength.”
BackgroundMethodResultInfluentialSelf-citationDavin, J. T., Aviv, A. J., Wolf, F., & Kuber, R. (2017) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3027063.3053221 · Cited by 8
“These features have also been identified and studied in prior work [1, 2].”
BackgroundSelf-citationBu-Dash: A Universal and Dynamic Graphical Password Scheme
Andriotis, P., Kirby, M., & Takasu, A. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-05563-8_14 · Cited by 7
Work in Progress: On the In-Accuracy and Influence of Android Pattern Strength Meters
Golla, M., Rimkus, J., Aviv, A. J., & Dürmuth, M. (2019) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2019.23025 · Cited by 6
Self-citationTouch gesture-based authentication: A security analysis of Pattern Unlock
Ibrahim, N., & Sellahewa, H. (2017) · IEEE International Conference on Identity, Security and Behavior Analysis (ISBA) · doi:10.1109/isba.2017.7947711 · Cited by 5
“Start Nodes Comparison Node Uellenbeck[16] Adam[1] Sun[10] Our Result”
BackgroundMethodBier, A., Kapczyński, A., & Sroczyński, Z. (2017) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-67792-7_4 · Cited by 5
User Perceptions of Five-Word Passwords
Wu, X., Munyendo, C. W., Cosic, E., Flynn, G. A., Legault, O., & Aviv, A. J. (2022) · Annual Computer Security Applications Conference · doi:10.1145/3564625.3567981 · Cited by 5
Self-citationGestureMeter: Design and Evaluation of a Gesture Password Strength Meter
Cheon, E., Huh, J. H., & Oakley, I. (2023) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3544548.3581397 · Cited by 5
“, the 20 attempts allowed with Android pattern lock [3, 51]).”
BackgroundZheng, J. J., & Chigurupati, S. K. (2018) · ICT Express · doi:10.1016/j.icte.2018.11.003 · Cited by 5
Katsini, C., Avouris, N. M., & Fidas, C. A. (2019) · i-com · doi:10.1515/icom-2019-0011 · Cited by 4
Using a Blocklist to Improve the Security of User Selection of Android Patterns.
Munyendo, C. W., Grant, M., Markert, P., Forman, T. J., & Aviv, A. J. (2021) · Symposium On Usable Privacy and Security · Cited by 4
Self-citationA Survey of Collection Methods and Cross-Data Set Comparison of Android Unlock PatternsPreprint
Aviv, A. J., & Duermuth, M. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.10548 · Cited by 4
“Good examples of online studies are ABK-MP-self, LDR, ZEBOdLAH, CHKCOSK, and TBLV [4, 26, 44, 13, 36].”
BackgroundMethodInfluentialSelf-citationData Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed SolutionsPreprint
Zinkus, M., Jois, T. M., & Green, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2105.12613 · Cited by 11
Stop to Unlock - Improving the Security of Android Unlock Patterns
Suchan, A., von Zezschwitz, E., & Krombholz, K. (2019) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2019.23017 · Cited by 3
“[3], the self-reported real-world 3x3 patterns offer an entropy of 9.”
BackgroundBend Passwords for People with Vision Impairment
Faustino, D. B. (2018) · doi:10.22215/etd/2018-13237 · Cited by 3
SPCL: A Smart Access Control System That Supports Blockchain
Wu, J., Xue, N., Li, Z., Hong, X., Zhao, Y., Huang, X., & Zhang, J. (2024) · Applied Sciences · doi:10.3390/app14072978 · Cited by 2
A Random and Unselectable Graphic Password Scheme
Wang, K. (2024) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac59436.2024.10503722 · Cited by 2
“Most of these improved graphic passwords mainly improve the password space of the AUP graphic password scheme, but the problems of shoulder scanning attacks and photo taking attacks still have not been solved [12].”
BackgroundSimilarities: The Key Factors Influencing Cross-Site Password Guessing Performance
Xie, Z., Shi, F., Zhang, M., Rao, Z., Zhou, Y., & Ji, X. (2025) · Electronics · doi:10.3390/electronics14050945 · Cited by 2
A Visibility-Based Upper Bound for Android Unlock Patterns
Lee, J., Seo, J. W., Cho, K., Lee, P. J., Kim, J., Choi, S. H., & Yum, D. H. (2016) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2016edl8095 · Cited by 2
"It's all about the start" classifying eyes-free mobile authentication techniques
Wolf, F., Aviv, A. J., & Kuber, R. (2018) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2018.05.004 · Cited by 4
Self-citationTwice as Nice? A Preliminary Evaluation of Double Android Unlock Patterns
Forman, T. J., Roche, D. S., & Aviv, A. J. (2020) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3334480.3382922 · Cited by 2
Self-citationSemanticLock: An authentication method for mobile devices using semantically-linked imagesPreprint
Olade, I., Liang, H., & Fleming, C. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.11361 · Cited by 2
“However, studies of user Pattern password creation by [4, 45, 46], found empirically that there is a high bias in the Pattern selection process resulting in low entropy and a practical effective security of less than a three digit randomly-assigned PIN.”
BackgroundWang, Y., Qiu, W., Xie, Y., & Zha, Y. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.01509 · Cited by 2
“In practice, an valid graphic pattern should satisfy the following requirements [5].”
BackgroundImproving Password Guessing With Isomorphism Modeling
Yang, X., Xiao, Z., Wu, X., Xing, K., Tang, H., Yang, T., Liang, K., & Xiong, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3616595 · Cited by 1
Position Paper: Measuring the Impact of Alphabet and Culture on Graphical Passwords.
Aviv, A. J., Dürmuth, M., & Gupta, P. (2016) · Symposium On Usable Privacy and Security · Cited by 1
Self-citationHollow-Pass: A Dual-View Pattern Password Against Shoulder-Surfing Attacks
Tan, J., & Sarmah, D. K. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-34671-2_18 · Cited by 1
Ibrahim, N., & Sellahewa, H. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00722-x · Cited by 1
Bailey, D. V., Munyendo, C. W., Dyer, H. A., Grant, M., Markert, P., & Aviv, A. J. (2023) · European Symposium on Usable Security (EuroUSEC) · doi:10.1145/3617072.3617113 · Cited by 1
“Prior work has analyzed the security of numerous knowledge-based authentication schemes used on mobile devices, for example, alpha-numeric passwords [34, 46], LG Knock Codes [45], and Android unlock patterns [5, 6, 9, 28, 35, 50].”
Self-citationTowards Understanding Connections between Security/Privacy Attitudes and Unlock Authentication
Aviv, A. J., & Kuber, R. (2018) · Workshop on Usable Security (USEC) · doi:10.14722/usec.2018.23011 · Cited by 1
Self-citationTsoukas, V., Kakarountas, A. P., Gkogkidis, A., & Giannakas, G. (2019) · Panhellenic Conference on Informatics · doi:10.1145/3368640.3368657 · Cited by 1
“In contrast to many people’s belief, the use of 4x4 grid instead of 3x3 grid does not make the system more secure [2].”
ResultA Visibility-Based Lower Bound for Android Unlock Patterns
Jinwoo, L. E. E., Seo, J. W., Kookrae, C. H. O., Pil Joong, L. E. E., & Yum, D. H. (2017) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2016edl8196 · Cited by 1
“While CyanLockScreen [1] provides grids from 3 × 3 to 6 × 6 and Security Lock Screen [2] up to 25 × 25, the total number of possible patterns is only known for 3×3 and 4×4 grids that was obtained by brute-force enumeration; there are 389,112 ( 219) patterns in a 3×3 grid and 4,350,069,823,024 ( 242) patterns in a 4 ×…”
MethodTowards Constructing Consistent Pattern Strength Meters with User’s Visual Perception
Park, L. H., Hwang, E., Lee, D., & Kwon, T. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-29371-9_5 · Cited by 1
Knock, Knock. Who's There? On the Security of LG's Knock CodesPreprint
Samuel, R., Markert, P., Aviv, A. J., & Neamtiu, I. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.03556 · Cited by 1
“This approach has been regularly applied to analyzing mobile authentication, such as Android Patterns [4, 44, 47] or PINs [38, 50].”
BackgroundMethodResultInfluentialSelf-citationSoK: Cryptographic Confidentiality of Data on Mobile Devices
Zinkus, M., Jois, T. M., & Green, M. (2021) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0029 · Cited by 6
Analyse der Sicherheit und Erinnerbarkeit der DsiN-Passwortkarte
Mayer, P. B., Kunz, A., & Volkamer, M. (2018) · Datenschutz und Datensicherheit - DuD · doi:10.1007/s11623-018-0946-9
“Ähnlich zu Sicherheitsanalysen von anderen Ansätzen [1, 2] identifi zieren wir Probleme: Die Startpunkte sind nicht zufällig im Raster verteilt und die meisten Verläufe in unserer Studie sind gerade Linien oder beinhalten lediglich eine Richtungsänderung.”
Quantifying the Security of Recognition Passwords: Gestures and SignaturesPreprint
Liu, C., Sugrim, S., Clark, G. D., & Lindqvist, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1812.09410
“a rather than through an estimation of the user-chosen distribution. Song et al. [40] proposed a strength meter for Android unlock patterns and evaluated it using partial guessing metric. Aviv et al. [7] studied the impact on the security of Android unlock pattern when the grid size was increased from 3 3 to 4 4 and f…”
Android Pattern Unlock Authentication - effectiveness of local and global dynamic features
Ibrahim, N., & Sellahewa, H. (2019) · Buckingham E-Archive of Research (University of Buckingham)
Tupsamudre, H., Vaddepalli, S., Banahatti, V., & Lodha, S. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363250
“We use Markov model based attack technique to estimate the guessing resistance of patterns in all five groups [1, 5, 7].”
InfluentialA Mixed Login Scheme Performed on Mobile Device to Resist Multiple Attack
Wan, J., Liu, L., Hua, D., & Liu, W. (2019) · doi:10.5121/csit.2019.91811
“There exists many kinds of side-channel attacks against patterns as well, including smudge attacks [15, 16, 17], sensor-based attacks [18] and random guessing attacks [21, 22, 23].”
BackgroundTwo-Dimensional Hybrid Authentication for ATM Transactions
Mridha, M. F., Rafiq, J. I., & Zaman, W. U. (2020) · Lecture notes in networks and systems · doi:10.1007/978-981-15-0694-9_19
Dixon, M., Sillence, E., Nicholson, J., & Coventry, L. (2023) · European Symposium on Usable Security (EuroUSEC) · doi:10.1145/3617072.3617104
“Android developers or manufacturers such as Samsung may consider more explicitly encouraging and supporting their users in setting up and familiarising themselves with remote access features.”
BackgroundInfluentialSmith-Creasey, M. (2023) · SpringerBriefs in computer science · doi:10.1007/978-3-031-49071-2_2
Spatial AI in Symbolic and Evolutionary AI
Papadimitriou, F. (2025) · SpringerBriefs in applied sciences and technology · doi:10.1007/978-3-031-82136-3_2
Sharma, I., & Joshi, A. N. (2025) · IFIP advances in information and communication technology · doi:10.1007/978-3-032-00777-3_5
Metadata
- Authors
- Aviv, A. J., Budzitowski, D., & Kuber, R.
- Affiliations
- United States Naval Academy (US)
- University of Maryland, Baltimore County (US)
- Venue
- Proceedings of the 31st Annual Computer Security Applications Conference
- Publisher
- ACM
- Published
- 2015-12-07
- Pages
- 301-310
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2254621492
- Cited by
- 68
- References
- 27
- Citations by year
- 2025: 4 · 2024: 2 · 2023: 8 · 2022: 6 · 2021: 8 · 2020: 5 · 2019: 9 · 2018: 13 · 2017: 9 · 2016: 4
- FWCI
- 7.53
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Locations
- Annual Computer Security Applications Conference (publishedVersion, other-oa)
- Maryland Shared Open Access Repository (USMAI Consortium) (submittedVersion, public-domain)
- Digital Repository at the University of Maryland (University of Maryland College Park) (public-domain)
- Funders
- Office of Naval Research
- National Security Agency
- Topics
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- grid size, password guessing, guessing entropy, repeated patterns, symmetric patterns, mobile authentication, password security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
