Easy To Draw, But Hard To Trace? On The Observability Of Grid-Based (Un) Lock Patterns

We performed a systematic evaluation of the shoulder surfing susceptibility of the Android pattern (un) lock. The results of an online study (n = 298) enabled us to quantify the influence of pattern length, line visibility, number of knight moves, number of overlaps and number of intersections on observation resistance. The results show that all parameters have a highly significant influence, with line visibility and pattern length being most important. We discuss implications for real- world patterns and present a linear regression model that can predict the observability of a given pattern. The model can be used to provide proactive security measurements for (un) lock patterns, in analogy to password meters.