Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.
Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies,
5(2), 2010.
What I was hoping somebody would study is the ability of practiced thieves to get the PIN under both circumstances. But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.
One quibble I have with the study is that they used novel PINs. I know I'm much faster when typing my real PIN than an arbitrary one. So I suspect the time penalty for random digit layout is larger than they show here.
> But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.
I wouldn't say certainly.
There's more time to observe each keystroke but you have to know what the keystroke is. I've deduced people's 4 digit pin, by accident, from an angle where I can barely see their screen. Randomizing the keypad prevents this.
I think it would only make shoulder-surfing easier if the shoulder-surfer was willing to make what they were doing more apparent.
Also if this was widespread, which I suppose it never will be, people would become used to the randomized keyboard and probably be able to do it a lot quicker.
This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.
I believe scrambling should work the best if you scramble the keypad for every digit entered, rather than for the whole of them at once. Otherwise at least the same key presses should be immediately recognisable?
I heard about a device that had fewer keys say 5 only, one for each finger, but to use it you had to insert your hand into a slot in the machine so it’s completely invisible from the outside what keys you’re pressing. Presumably in theory they could use one slot for each hand to get to the full 10 digit range.
Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen).
Trezor has a separate screen... that screen has your numbers, your computer screen has a blank grid of 3x3. You look at the Trezor and press the correct number in the blank grid.
I remember when Runescape added that to opening your bank account. Perhaps it was to deter bots, but also to stop any key/mouse loggers from giving away your secrets.
