Knock, Knock. Who's there? On the security of LG's knock codes

Document Type

Conference Proceeding

Publication Date

1-1-2020

Abstract

Knock Codes are a knowledge-based unlock authentication scheme used on LG smartphones where a user enters a code by tapping or “knocking” a sequence on a 2x2 grid. While a lesser-used authentication method, as compared to PINs or Android patterns, there is likely a large number of Knock Code users; we estimate, 700,000-2,500,000 in the US alone. In this paper, we studied Knock Codes security asking participants in an online study to select codes on mobile devices in three settings: a control treatment, a blocklist treatment, and a treatment with a larger, 2x3 grid. We find that Knock Codes are significantly weaker than other deployed authentication, e.g., PINs or Android patterns. In a simulated attacker setting, 2x3 grids offered no additional security. Blocklisting, on the other hand, was more beneficial, making Knock Codes' security similar to Android patterns. Participants expressed positive perceptions of Knock Codes, yet usability was challenged. SUS values were “marginal” or “ok” across treatments. Based on these findings, we recommend deploying blocklists for selecting a Knock Code because they improve security but have a limited impact on usability perceptions.

Identifier

85091827128 (Scopus)

ISBN

[9781939133168]

Publication Title

Proceedings of the 16th Symposium on Usable Privacy and Security Soups 2020

First Page

37

Last Page

60

Grant

1617584

Fund Ref

National Science Foundation

This document is currently not available here.

Share

COinS