If you really don’t want anybody accessing your phone, keep your screen clean! Otherwise, your phone password may get stolen within seconds. Especially if you use swipe.

Introduction

This is a 21st century - even kids have touchscreen smartphones nowadays. You may be shocked, but the device that you are holding in your hands that has all the information about you, can be hacked within seconds.

Backstory

Today at work I was able to identify 3 of my co-workers phone passwords. The trick is easy, just hold your phone pointing at a light source at an angle so that you can see all the “smudge”s on the screen. There you go! Do you see your pattern? Your “smudge”s are your password! Awesome, right?! Well, maybe not.

This attack is in fact called “Smudge Attack”

Your device is INSECURE!

It doesn’t really matter what type of password security you use, be it swipe, number pad, character password… all can be identified within seconds. Of course, each type of password security is stronger than the previous type, but it increases the amount of time to guess your phone password by only few seconds.

Having your “smudge”s stolen will decrease the amount of possible keys to crack your password. For example, if you were using a number pad based password and your pattern is {1, 3, 9, 0}, then you have only 4 x 3 x 2 x 1 = 24 different possible keys (on 4 digit key). However, your password is possibly one of the following four: “0913”,”0931”,”1309”,”3109” - because it is most probably your birthday, or it may be something else. Point is - you and I are humans, we have habits and they give us away. This makes any security system insecure.

Here is a bit lengthier research paper done on “Smudge Attack” by University of Pennsylvania: Link

“Oh, I use fingerprint”

Well, I am sorry, but you are even more screwed. Your fingerprint can be hacked with an inkjet printer. Here is a video showing how it’s done: Video, research by Michigan State University.

How secure are you?

Answer has always been the same. No matter what system or device you use, the security behind it is meant to protect you from other regular people who are not hackers. However, if you become a real target for somebody, it is not hard for them to hack you.

Conclusion

In conclusion, you may be better off by cleaning your screen and wiping your fingerprints off if you really do want true security. These securities are meant for only consumer use. Meaning that they are generic and meant to have better user experience rather than security. So your security essentially is in your hands only and you are the only person who can protect you.