Evaluating the Usability and Security of Input Masking Techniques

Abstract

The human remains the weakest link in computer security, and one popular method of breaching security is shoulder surfing: looking at a user’s screen or keyboard as he or she enters sensitive input. Various masking techniques exist to hide text from shoulder surfers; the most common of these replaces entered text with bullets. Existing research focuses on how to improve the shoulder surfing resistance of bulletmasking, at a heavy cost to usability. We developed Purloin: an input masking technique designed to maintain the same level of security while increasing usability. We recruited pairs of participants (filling both user and shoulder surfer roles) and tested five different masking techniques on objective measures of usability and security, subjective measures of usability and workload, and user preference. We found that Purloin performed near the top in both usability and security and received the highest overall preference ranking. Bullet-masking was equally secure but less usable. The other masking techniques performed significantly worse than Purloin in either usability, security, or both.

Get full access to this article

View all access options for this article.

References

Burr

W. E.

Dodson

D. F.

Polk

W. T.

(2006). Electronic authentication guideline: Recommendations of the National Institute of Standards and Technology. Gaithersburg, MD: U.S. Dept. of Commerce, Technology Administration, National Institute of Standards and Technology.

Damerau

(1964). A technique for computer detection and correction of spelling errors. Communications of the ACM, 7(3), 171-176.

Forget

Chiasson

Biddle

(2010). Shoulder-surfing resistance with eye-gaze entry in cued-recall graphical passwords. Proceedings of the 28th International Conference on Human Factors in Computing Systems, 1107-1110.

Hart

S. G.

Staveland

(1988). Development of NASA-TLX: Results of empirical and theoretical research. In Hancock

P. A.

Meshkati

(Eds.), Human Mental Workload (pp. 239-250). Amsterdam: North-Holland Press.

Hoanca

Mock

(2005). Screen oriented technique for reducing the incidence of shoulder surfing. Proceedings of the 2005 International Conference on Security and Management, 334-340.

Lewis

J. R.

(1995). IBM computer usability satisfaction questionnaires: Psychometric evaluation and instructions for use. International Journal of Human Computer Interaction, 7(1), 57-78.

Nielsen

(2009, June 23). Stop password masking. Retrieved February 17, 2011, from http://www.useit.com/alertbox/passwords.html

Roth

Richter

Freidinger

(2004). A PIN-entry method resilient against shoulder surfing. Proceedings of the 11th ACM Conference on Computer and Communications Security, 236-245.

Tari

Ozok

A. A.

Holden

S. H.

(2006). A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords. Proceedings of the Second Symposium on Usable Privacy and Security, 56-66.

10.

Wiedenbeck

Waters

Sobrado

Birget

J. C.

(2006). Design and evaluation of a shoulder-surfing resistant graphical password scheme. Proceedings of the Working Conference on Advanced Visual Interfaces, 177-184.

11.

Winkler

W. E.

(1990). String comparator metrics and enhanced decision rules in the Fellegi-Sunter model of record linkage. Proceedings of the Section on Survey Research Methods, 354-359.