Could Smudges on Touchscreen Phones Give Away User Passwords?

The greasy fingerprints and oily residues left on your touchscreen devices are unpleasant to look at, but it turns out this is not the only flaw – they also pose potential security threats to users as they can be used to infer our passwords, according to researchers.

In a recently published report, researchers at the University of Pennsylvania revealed how partial or complete password patterns can be retrieved by lifting and studying the smudge marks on screens. These smudges, or oily residues, left behind by fingers on smartphones and other touchscreen devices, are surprising persistent in time and difficult to remove even through wiping. And since collecting and analyzing residue oils can be done simply using a camera and a computer with photo-editing software, the threat of "smudge attack" is quite high, according to the researchers.

In an experiment, the group tested two Android handsets, the Google Nexus One and the HTC G1, under various lighting and camera orientation settings. By taking a photo of the screen under a perfect lighting condition, and enhancing its contrast and brightness in the computer, the phone's password was able to be identified completely 68 percent of the time, and partly 92 percent of the time.

The researchers noted that phones powered by Google's Android software are particularly prone to "smudge attack" because they use nine-point graphical codes to unlock, unlike the iPhone and other handsets that use traditional numeric passwords. A user has to swipe on the touchscreen without lifting their fingers, leaving a greasy trail that can be traced back.

The analyzing techniques can be applied to other smartphones and touchscreen-based devices, such as ATMs and voting machines. However, the group said the Android password pattern, in particular, is in need of strengthened security. If you own a touchscreen handset, it would be better for you to wipe the screen with a cleaning cloth and some cleaning fluid after entering a password, instead of just slipping it back into your pocket.

Tags: LCD Cleaning Kit, Cleaning Cloth, Screen Protectors, HTC Accessories, iPhone Accessories, Nexus One Accessories, T-Mobile G1 (Google Phone) Accessories