I have read a post from Eric Vetillard (javacard expert amongst all and a
colleague), about smudge attack against android terminals.
To quote his post :
this attack targets the authentication pattern that is used to unlock an
Android phone. .... owners also know that smudge really is dangerous for this
authentication technique. I have tried it with a colleague: after picking up my
phone, it took him 3 tries to get my combination
Why that ? Because :
- fingers are sweaty or greasy or both (weather is good in the south of
France, isn't it Eric ?) so they leave traces on our shining screens
- there is only one path to unlock the phone
- this path 'looks' always the same on the phone
So, that post triggered some thinking. I think I've found possible solutions
:)
First proposal
The pattern has to not be static. To reach that, my proposal is to have the
dots or equivalents to be in a circle that will rotate.
Not randomly but more like a compass.
Just like a compass has an arrow, an arrow is used so that the user has a
landmark and not get lost
Then either link the dots to unlock. (5 tries are allowed instead of 3)
With that, you will never not touch the screen at the same place (unless you
unlock only at the very same place, with the same position of the body)
Derivated proposal :
A keyboard which keys are never at the same place, used to enter PIN
code.
Most of us already know that, as this is used by online banks. The proposal is
to integrate it as a proposed unlocking system.
Third proposal, I call it the psycho-camembert :)
It looks like a camembert (or pie chart) with equal parts coloured differently
and having patterns (stripes, dots, etc ..).
This camembert is centered on the screen. Those parts are displayed in a random
order.
To unlock, parts have to be dragged toward the exterior. Therefore, the traces
on the screen are all lines from the center to the outside.
Of course, its a memory thing and one will have to memorize a colour order.
Sorry for those who cannot distinguish colors, thats why patterns can be
added.
I hope this contribution will find its way to the good ears.
Let's be frank, all the better if it brings me an all-inclusive invitation to
IO 2011 !
I really liked San Francisco and have no idea on how to deserve an invite for
next year.
Feel free to indicate me the classes of the API to look at in order to
implement it.
Cheers,
Jérôme
Eric's post is here http://javacard.vetilles.com/2010/10/18/smudge-attacks-on-android
You can follow Eric on Twitter : @evetillard http://twitter.com/evetillard