In this paper, we present XSide, an authentication mechanism that uses the front and the back of smartphones to enter stroke-based passwords. Users can switch sides during input to minimize the risk of shoulder surfing. We performed a user study (n = 32) to explore how switching sides during authentication affects usability and security of the system. The results indicate that switching the sides increases security while authentication speed stays relatively fast (≤ 4 seconds). The paper furthermore provides insights on accuracy of eyes-free input (as used in XSide) and shows how 3D printed prototype cases can improve the back-of-device interaction experience.

This paper presents BoD Shapes, a novel authentication method for smartphones that uses the back of the device for input. We argue that this increases the resistance to shoulder surfing while remaining reasonably fast and easy-to-use. We performed a user study (n=24) comparing BoD Shapes to PIN authentication, Android grid unlock, and a front version of our system. Testing a front version allowed us to directly compare performance and security measures between front and back authentication. Our results show that BoD Shapes is significantly more secure than the three other approaches. While performance declined, our results show that BoD Shapes can be very fast (up to 1.5 seconds in the user study) and that learning effects have an influence on its performance. This indicates that speed improvements can be expected in long-term use.

Using digital gadgets we authenticate ourselves regularly. Usually authentication relies on standard PIN or password but novel input hardware facilitates new authentication techniques. In this work we present an authentication mechanism based on body movements captured by a depth sensor. This idea is motivated by the cultural body movements used as welcoming gestures, especially by gang members (secret handshakes). Our authentication technique 'BroAuth' lets the user interact with a virtual partner to perform password input. This is done through touching target zones on the own body and on the body of a virtual partner.

Internet users are targets for ever-advancing phishing- and other attacks. The risks are, for example, to disclose credit card information or passwords to unauthorized instances. One approach to help users with insecure situations is provided by MoodyBoard, which uses ambient information to highlight potential risks. In this paper, we present findings from an evaluation of this system. Two user studies were conducted in order to find out whether an ambient security tool can protect users during sensitive tasks. We designed a pilot study to find out whether users understand the warnings and a security study to see if it helps to protect users from phishing attacks. Results show that MoodyBoard users behaved significantly more secure.

When browsing the Internet, users are likely to be exposed to security and privacy threats -- like fraudulent websites. Automatic browser mechanisms can protect them only to some extent. In other situations it is still important to raise the users' security awareness at the right moment. Passive indicators are mostly overlooked and blocking warnings are quickly dismissed by habituated users. In this work, we present a new concept of warnings that appear in-context, right next to data the user has just entered. Those dialogs are displayed whenever critical data types -- e.g. credit card data -- are entered by the users into online forms. Since they do not immediately interrupt the users' interaction but appear right in the users' focus, it is possible to place important security information in a way that it can be easily seen.

To counter the increasing number of online threats for users' privacy and security, this paper explores the design of an ambient security indicator, in form of a standard keyboard illuminated in different colors, and equipped with additional buttons and vibration functionality. We present the results of a focus group study, which notably influenced the design, and discuss a prototypical implementation called Moody Board.

With SeCuUI we present a solution that aims to increase security of data entry on public terminals. The user can enter all data requested by the terminal using her mobile device. Sensitive data can be hidden from prying eyes by exclusively showing it on the user's mobile. To speed up the whole process, the SeCuUI-client stores previously entered data on the mobile device to provide auto form filling capabilities.