SteganoPIN: Two-Faced Human-Machine Interface for Practical Enforcement of PIN Entry Security

Taekyoung Kwon, Sarang Na

Research output: Contribution to journalArticlepeer-review

15 Citations (Scopus)


Users typically reuse the same personalized identification number (PIN) for multiple systems and in numerous sessions. Direct PIN entries are highly susceptible to shoulder-surfing attacks as attackers can effectively observe PIN entry with concealed cameras. Indirect PIN entry methods proposed as countermeasures are rarely deployed because they demand a heavier cognitive workload for users. To achieve security and usability, we present a practical indirect PIN entry method called SteganoPIN. The human-machine interface of SteganoPIN is two numeric keypads, one covered and the other open, designed to physically block shoulder-surfing attacks. After locating a long-Term PIN in the more typical layout, through the covered permuted keypad, a user generates a one-Time PIN that can safely be entered in plain view of attackers. Forty-eight participants were involved in investigating the PIN entry time and error rate of SteganoPIN. Our experimental manipulation used a within-subject factorial design with two independent variables: PIN entry system (standard PIN, SteganoPIN) and PIN type (system-chosen PIN, user-chosen PIN). The PIN entry time in SteganoPIN (5.4-5.7 s) was slower but acceptable, and the error rate (0-2.1%) was not significantly different from that of the standard PIN. SteganoPIN is resilient to camera-based shoulder-surfing attacks over multiple authentication sessions. It remains limited to PIN-based authentication.

Original languageEnglish
Article number7167675
Pages (from-to)143-150
Number of pages8
JournalIEEE Transactions on Human-Machine Systems
Issue number1
Publication statusPublished - 2016 Feb

Bibliographical note

Publisher Copyright:
© 2013 IEEE.

All Science Journal Classification (ASJC) codes

  • Human Factors and Ergonomics
  • Control and Systems Engineering
  • Signal Processing
  • Human-Computer Interaction
  • Computer Science Applications
  • Computer Networks and Communications
  • Artificial Intelligence


Dive into the research topics of 'SteganoPIN: Two-Faced Human-Machine Interface for Practical Enforcement of PIN Entry Security'. Together they form a unique fingerprint.

Cite this