Using a Blocklist to Improve the Security of User Selection of Android Patterns

Collins W. Munyendo^, Miles Grant^, Philipp Markert^‡, Timothy J. Forman^§, Adam J. Aviv^*

^The George Washington University, ^‡Ruhr University Bochum, ^§United States Navy*

Abstract

Android patterns remain a popular method for unlocking smartphones, despite evidence suggesting that many users choose easily guessable patterns. In this paper, we explore the usage of blocklists to improve the security of user-chosen patterns by disallowing common patterns, a feature currently unavailable on Android but used by Apple during PIN selection. In a user study run on participants' smartphones (n=1006), we tested 5 different blocklist sizes and compared them to a control treatment. We find that even the smallest blocklist (12 patterns) had benefits, reducing a simulated attacker's success rate after 30 guesses from 24% to 20%. The largest blocklist (581 patterns) reduced the percentage of correctly guessed patterns after 30 attempts down to only 2%. In terms of usability, blocklists had limited negative impact on short-term recall rates and entry times, with reported SUS values indicating reasonable usability when selecting patterns in the presence of a blocklist. Based on our simulated attacker performance results for different blocklist sizes, we recommend blocking 100 patterns for a good balance between usability and security.

Study Data

We share the dataset of user-chosen Android Patterns with other research institutions upon request.

Technical Paper

Our work appeared at the 17th Symposium on Usable Privacy and Security.

Paper Slides Talk

BibTeX

Please use the following BibTeX entry to cite the paper:

@inproceedings{munyendo-21-pattern-blocklists, 
    author = {Munyendo, Collins W. and Grant, Miles and Markert, Philipp and Forman, Timothy J. and Aviv, Adam J.}, 
    title = {{Using a Blocklist to Improve the Security of User Selection of Android Patterns}}, 
    booktitle = {Symposium on Usable Privacy and Security}, 
    year = {2021}, 
    series = {SOUPS~'21}, 
    pages = {37--56}, 
    address = {Virtual Conference}, 
    month = aug, 
    publisher = {USENIX}
}