PrivacyScout: Assessing Vulnerability to Shoulder Surfing on Mobile Devices
Authors: Mihai Bâce (University of Stuttgart, Germany), Alia Saad (University of Duisburg-Essen, Germany), Mohamed Khamis (University of Glasgow, United Kingdom), Stefan Schneegass (University of Duisburg-Essen, Germany), Andreas Bulling (University of Stuttgart, Germany)
Volume: 2022
Issue: 3
Pages: 650–669
DOI: https://doi.org/10.56553/popets-2022-0090
Abstract: One approach to mitigate shoulder surfing attacks on mobile devices is to detect the presence of a bystander using the phone’s front-facing camera. However, a person’s face in the camera’s field of view does not always indicate an attack. To overcome this limitation, in a novel data collection study (N=16), we analysed the influence of three viewing angles and four distances on the success of shoulder surfing attacks. In contrast to prior works that mainly focused on user authentication, we investigated three common types of content susceptible to shoulder surfing: text, photos, and PIN authentications. We show that the vulnerability of text and photos depends on the observer’s location relative to the device, while PIN authentications are vulnerable independent of the observation location. We then present PrivacyScout – a novel method that predicts the shoulder-surfing risk based on visual features extracted from the observer’s face as captured by the front-facing camera. Finally, evaluations from our data collection study demonstrate our method’s feasibility to assess the risk of a shoulder surfing attack more accurately.
Keywords: Privacy, Security, Mobile Devices, Frontfacing Camera
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 license.
