论文标题
敲门。谁在那里？关于LG的敲门代码的安全
Knock, Knock. Who's There? On the Security of LG's Knock Codes
论文作者
论文摘要
敲门代码是在LG智能手机上使用的基于知识的解锁身份验证方案，在该方案中，用户通过敲击或“敲击” 2x2网格上的序列进入代码。尽管与引脚或Android模式相比，使用较少使用的身份验证方法，但可能有大量的敲门代码用户。我们仅在美国就估计700,000--2,500,000。在本文中，我们研究了敲门码安全性，要求参与者在三种设置中选择移动设备上的代码：一种控制处理，块列治疗和更大的2x3网格的处理。我们发现，敲击代码明显弱于其他部署的身份验证，例如引脚或Android模式。在模拟的攻击者设置中，2x3网格没有提供额外的安全性，但是块列表更有益，使敲门代码的安全性类似于Android模式。参与者对敲门代码表示积极的看法，但可用性受到挑战。 SUS值在治疗中为“边际”或“确定”。基于这些发现，我们建议部署黑名单来选择敲击代码，因为它可以提高安全性，但对可用性感知的影响有限。
Knock Codes are a knowledge-based unlock authentication scheme used on LG smartphones where a user enters a code by tapping or "knocking" a sequence on a 2x2 grid. While a lesser used authentication method, as compared to PINs or Android patterns, there is likely a large number of Knock Code users; we estimate, 700,000--2,500,000 in the US alone. In this paper, we studied Knock Codes security asking participants to select codes on mobile devices in three settings: a control treatment, a blocklist treatment, and a treatment with a larger, 2x3 grid. We find that Knock Codes are significantly weaker than other deployed authentication, e.g., PINs or Android patterns. In a simulated attacker setting, 2x3 grids offered no additional security, but blocklisting was more beneficial, making Knock Codes' security similar to Android patterns. Participants expressed positive perceptions of Knock Codes, but usability was challenged. SUS values were "marginal" or "ok" across treatments. Based on these findings, we recommend deploying blacklists for selecting a Knock Code because it improves security but has limited impact on usability perceptions.
