REVIEW 3 major objections 6 minor 27 references
Augmented Unlocking Techniques for Smartphones Using Pre-Touch Information
T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read A smartphone unlock method that reads a 3D cube from a hovering finger is claimed to defeat smudge attacks and resist shoulder surfing.
desk verdict New pre-touch authentication idea with a credible prototype, but the key shoulder-surfing result rests on p-values that cannot occur with n=6 and needs an exact re-analysis. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the 3D Pattern lock: a $3\times3\times3$ cube of cylinders rendered with an orthographic projection, where each depth layer is colored distinctly and a cursor changes color with the finger's height. The mechanism that carries the argument is pre-touch sensing, the ability to track finger position before it makes contact with the screen; in the prototype this is simulated with an infrared motion-capture system and fiducial markers. The defining property is that the secret is expressed in three dimensions, so no oily residue is left on the glass and the layer in which the finger hovers is not directly visible to a shoulder surfer. The paper also uses a no-feedback mode, omitting lines between connected points, and haptic feedback to confirm input without visual disclosure.
What would settle it
Run the same authentication task on a device with built-in pre-touch sensing, or a high-resolution low-latency simulator, with a larger participant group. If median entry time remains near 8 seconds and error rate near 52%, or if shoulder-surfing guess counts are not significantly higher than for PIN, the central usability and security claims would be contradicted.
Extended reading notes
Core claim
The central claim is that pre-touch information, sensed while a finger hovers above the display, can be used to build an authentication scheme that eliminates screen smudges by design and makes shoulder-surfing inference harder. The proposed 3D Pattern lock extends the familiar Android 3x3 grid into a 3 by 3 by 3 cube of layers; the user connects points by moving a finger through three-dimensional space, with each layer represented by a different color and a cursor that changes color with height. The paper reports that the constrained password space contains 19,192 valid patterns, larger than a four-digit PIN's 10,000 or a four-point Android pattern's 1,400. In the pilot evaluation, shoulder surfers needed significantly more guesses to recover a 3D Pattern than a PIN, and the empirical distribution suggests a larger study could also show an advantage over the standard pattern lock. The authors attribute the slow entry time and high error rate to the novelty of hovering input and to the motion-capture prototype, not to a fundamental flaw in the concept.
Load-bearing premise
The technique works only if future commodity smartphones can sense a hovering finger's 3D position with accuracy and latency comparable to the motion-capture rig used in the pilot; if the real sensor is coarser or slower, the measured speed, error rate, and shoulder-surfing resistance will not carry over.
Editorial extensions
If this is right
- If commodity pre-touch sensors reach sufficient accuracy, users could unlock phones with a secret that leaves no smudge trace on the screen, directly closing the smudge-attack vector.
- Shoulder surfers, whether watching over a shoulder or reviewing video, would need more attempts to infer the secret because the finger's depth layer is hidden; the reported significant difference from PIN suggests real security gains.
- The 19,192-pattern worst-case space exceeds that of four-digit PINs and four-point Android patterns, so the security improvement is not obtained by shrinking the secret space.
- The design can operate without visual feedback and with haptic confirmation, making observation harder without requiring users to memorize sounds or additional associations.
Reading between the lines
- The pilot's 8-second median and 52% error rate likely overstate the difficulty users would face with mature pre-touch hardware: the motion-capture rig adds jitter, network latency, and an unfamiliar wearing experience, all of which the paper identifies as artifacts.
- If real pre-touch sensors have lower spatial resolution or higher latency than the prototype, the reported usability numbers could worsen, so the technique's viability hinges on sensing quality more than on the authentication concept itself.
- The paper's proposed depth cues, such as finger shadows, depth-of-field blur, or perspective projection, could substantially reduce the 52% error rate and are a natural next experiment.
- Combining pre-touch depth information with picture-based or semantically linked passwords, as the authors suggest, could yield secrets that are both memorable and less position-sensitive than a 3D cube pattern.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces '3D Pattern,' a smartphone authentication technique that extends the Android pattern lock into a 3×3×3 cube of layers, using pre-touch sensing (finger hovering above the screen) to select points without touching the display. The authors implement a prototype using a Vicon motion-capture system to simulate pre-touch, and report a pilot study with six participants comparing 3D Pattern against conventional PIN and Android pattern locks in terms of entry time, error rate, and shoulder-surfing resistance (measured by having participants guess credentials from videos of the previous participant). The paper claims that 3D Pattern is immune to smudge attacks (by design, since the finger never contacts the screen), that it is slower and more error-prone than the baselines, that its valid password space (19,192 patterns) exceeds those of four-digit PINs (10,000) and four-point Android patterns (1,400), and that it 'promises to be more resistant' to shoulder surfing based on statistical comparisons of guess counts.
Significance. If the empirical claims were properly supported, the paper would be a useful contribution to mobile usable security: it proposes a genuinely novel authentication modality that eliminates the smudge-attack vector by construction, while providing a password space larger than conventional PINs. The open-source prototype and the concrete enumeration of the valid pattern space are also strengths. However, the headline security claim—that 3D Pattern is more resistant to shoulder surfing than PIN—rests entirely on statistical tests whose reported p-values are impossible under the stated within-subjects design with n=6. The smudge-immunity claim is analytic and sound, and the usability findings (approximately 8 seconds entry time, 52% error rate) are descriptive and likely qualitatively robust, but the central security benefit is not currently established by the evidence. The issues are correctable through re-analysis and revised claims, so the paper is a candidate for major revision rather than rejection.
major comments (3)
- [Section 7 (Results)] The post hoc paired Wilcoxon and paired t-test p-values reported for entry time, error rate, and shoulder-surfing guesses are impossible with n=6 participants. For a paired two-sided test with six pairs, the smallest achievable exact p-value is 2/2^6 = 0.031 (one-sided: 1/64) for the Wilcoxon signed-rank test, and the same bound applies to a paired t-test under full separation. Yet the paper reports p < 0.0001 for entry time and error-rate comparisons and p < 0.01 for the shoulder-surfing guess comparison. These values cannot arise from six paired observations and indicate that individual trials or patterns were pooled as independent units, which violates the within-subjects design and inflates significance. The authors must re-analyze the data with the participant as the unit of analysis, using exact nonparametric tests (e.g., exact Wilcoxon or permutation tests) and reporting exact p-values; if a different unit is intended, the paper must state this clearly and justify how the within-subjects dependence is modeled.
- [Section 7 (Friedman tests)] The Friedman tests are misreported with respect to degrees of freedom and the post hoc comparisons cannot be supported. With three techniques, the Friedman test has k-1 = 2 degrees of freedom, not the χ^2_3 shown for both the error-rate result (χ^2_3 = 17.72, p < 0.001) and the guesses result (χ^2_3 = 9.4, p < 0.05). More importantly, for the shoulder-surfing guess comparison between Pattern3D and PIN, even the most favorable possible exact two-sided Wilcoxon signed-rank p-value with n=6 is 0.031, which would not survive Holm correction for three comparisons; the claimed post hoc p < 0.01 is impossible. Therefore the statement in Section 8.1 and the abstract that 3D Pattern is 'promises to be more resistant' to shoulder surfing is not supported by the reported analysis. At best, Figure 8 suggests a trend that a larger study might confirm. The authors should recompute all nonparametric analyses with exact tests and appropriate multiplicity correction, and temper the security claim to the actual strength of the evidence.
- [Section 6.3 and Section 7 (shoulder-surfing measure)] The unit of analysis for the shoulder-surfing guess data is ambiguous. The design gives each participant two PINs or patterns per technique, each with two blocks of five trials (one practice, one analyzed), and the shoulder-surfing task shows 'the last successful authentication of each PIN or pattern for each technique.' It is not clear whether the guess count is recorded per pattern (yielding up to two observations per participant per technique) or aggregated per technique, how the 'up to 20 guesses' are allocated per video, and how ties (many observations have guesses of 1 or 2) are handled in the Friedman and Wilcoxon procedures. This ambiguity matters for the re-analysis and for interpreting the reported medians and means. The authors should specify the exact unit, the number of paired observations contributing to each test, and their treatment of ties in the exact nonparametric tests.
minor comments (6)
- [Section 6.4 and Section 7] There are typos: 'techniqe' appears instead of 'technique' in Section 6.4 and in the Friedman test descriptions in Section 7, and 'TechniqueEntry Time' and 'technique Error Rate' are missing spaces.
- [References] References [23] and [24] both cite the same paper (Tan, Keyani, and Czerwinski, 2005); the duplicate should be removed or consolidated.
- [Section 4.1] The phrase 'worst-case password space' is imprecise; the paper means the total number of valid patterns, not a worst-case attack scenario. Consider writing 'the size of the valid password space' for clarity.
- [Abstract, Section 8.1, and Section 9] The abstract says the technique 'promises to be more resistant' to shoulder surfing, while the conclusion says it 'could be more resistant.' After the statistical re-analysis, the wording should be aligned with the actual strength of the evidence, and the abstract should not make a stronger claim than the analysis supports.
- [Section 8.2] The paper appropriately discusses Vicon jitter and network latency as limitations, but it should also state explicitly that the measured entry time (8 seconds) and error rate (52%) are specific to the motion-capture prototype and may not transfer to a commodity pre-touch device with different spatial resolution and latency.
- [Throughout] The terms 'Pattern3D' and '3D Pattern' are used interchangeably; choosing one consistently would improve readability.
Circularity Check
No circularity: the security claims are analytic or empirical comparisons against external baselines, not re-derivations of the paper's own inputs.
full rationale
The paper's central claims are (1) smudge immunity and (2) improved shoulder-surfing resistance for the proposed 3D Pattern technique. Smudge immunity is analytic: because the user never touches the screen, no oily residue is left, and the paper states this directly rather than deriving it from data. Shoulder-surfing resistance is an empirical comparison measured by guess counts against PIN and pattern baselines; no fitted parameter is relabeled as a prediction. The password-space claim (19192 valid 3D patterns) is obtained by an explicit recursive enumeration under stated usability constraints and is compared against independently known values for PIN (10000) and Android pattern (1400). There is no equation in which the target conclusion is substituted into its own definition, and there is no load-bearing self-citation chain: cited prior work supplies external facts about smudge attacks, pre-touch sensing, and shoulder-surfing studies. The statistical irregularities noted in Section 7, such as p-values that appear impossible for n=6 and the reported Friedman degrees of freedom, are correctness and reporting concerns rather than circularity, since they do not make the empirical claim true by construction. On the circularity axis, the derivation is self-contained and the score is 0.
Assumptions & free parameters
free parameters (1)
- 3D pattern validity constraints (start top layer, max segment length sqrt(3), no middle-layer bypass) =
sqrt(3) units; start top layer; no bypass
assumptions (4)
- domain assumption Pre-touch sensing will be available on commodity smartphones
- domain assumption Vicon motion capture faithfully simulates pre-touch input
- domain assumption Shoulder-surfing video from a single over-the-shoulder camera captures the relevant attacker view
- domain assumption Haptic feedback is inaudible to attackers in ambient noise
Cite this review
Pith. "Pith review of Augmented Unlocking Techniques for Smartphones Using Pre-Touch Information." pith.science (2026). https://pith.science/paper/AX2CSZQ7
@misc{pith2026190809165,
author = {Pith},
title = {Pith review of: Augmented Unlocking Techniques for Smartphones Using Pre-Touch Information},
year = {2026},
howpublished = {\url{https://pith.science/paper/AX2CSZQ7}},
note = {Machine review of arXiv:1908.09165}
}
read the original abstract
Smartphones store a significant amount of personal and private information, and are playing an increasingly important role in people's lives. It is important for authentication techniques to be more resistant against two known attacks called shoulder surfing and smudge attacks. In this work, we propose a new technique called 3D Pattern. Our 3D Pattern technique takes advantage of a new input paradigm called pre-touch, which could soon allow smartphones to sense a user's finger position at some distance from the screen. We implement the technique and evaluate it in a pilot study (n=6) by comparing it to PIN and pattern locks. Our results show that although our prototype takes about 8 seconds to authenticate, it is immune to smudge attacks and promises to be more resistant to shoulder surfing.
Figures
Figures from the paper (5 more)
Reference graph
Works this paper leans on
-
[1]
Aviv, Katherine Gibson, Evan Mossop, Matt Blaze, and Jonathan M
Adam J. Aviv, Katherine Gibson, Evan Mossop, Matt Blaze, and Jonathan M. Smith
-
[2]
Andrea Bianchi, Ian Oakley, Vassilis Kostakos, and Dong Soo Kwon. 2011. The Phone Lock: Audio and Haptic Shoulder-surfing Resistant PIN Entry Methods for Mobile Devices. In Proceedings of the Fifth International Conference on Tangible, Embedded, and Embodied Interaction (TEI ’11). ACM, New York, NY, USA, 197–200. https://doi.org/10.1145/1935701.1935740
arXiv 2011
-
[4]
Peng Cheng, Ibrahim Bagci, Utz Roedig, and Jeff Yan. 2018. SonarSnoop: Active Acoustic Side-Channel Attacks. https://arxiv.org/abs/1808.10250. https://arxiv. org/abs/1808.10250
work page Pith review arXiv 2018
-
[5]
Hsin-Yi Chiang and Sonia Chiasson. 2013. Improving User Authentication on Mobile Devices: A Touchscreen Graphical Password. In Proceedings of the 15th International Conference on Human-computer Interaction with Mobile Devices and Services (MobileHCI ’13) . ACM, New York, NY, USA, 251–260. https://doi.org/10. 1145/2493190.2493213
arXiv 2013
-
[6]
Alexander De Luca, Roman Weiss, and Heinrich Hussmann. 2007. PassShape: Stroke Based Shape Passwords. In Proceedings of the 19th Australasian Conference on Computer-Human Interaction: Entertaining User Interfaces (OZCHI ’07) . ACM, New York, NY, USA, 239–240. https://doi.org/10.1145/1324892.1324943
arXiv 2007
-
[7]
Malin Eiband, Mohamed Khamis, Emanuel von Zezschwitz, Heinrich Hussmann, and Florian Alt. 2017. Understanding Shoulder Surfing in the Wild: Stories from Users and Observers. In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems (CHI ’17) . ACM, New York, NY, USA, 4254–4265. https://doi.org/10.1145/3025453.3025636
arXiv 2017
-
[8]
Mario Frank, Ralf Biedert, Eugene Ma, Ivan Martinovic, and Dawn Song. 2013. Touchalytics: On the Applicability of Touchscreen Input as a Behavioral Biometric for Continuous Authentication. IEEE Transactions on Information Forensics and Security 8, 1 (January 2013), 136–148. https://doi.org/10.1109/TIFS.2012.2225048
-
[9]
Meriem Guerar, Alessio Merlo, and Mauro Migliardi. 2017. Clickpattern: A pattern lock system resilient to smudge and side-channel attacks. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 8 (January 2017), 64–78
work page 2017
Show all 27 references
-
[10]
Marian Harbach, Alexander De Luca, and Serge Egelman. 2016. The Anatomy of Smartphone Unlocking: A Field Study of Android Lock Screens. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (CHI ’16) . ACM, New York, NY, USA, 4806–4817. https://doi.or...
2016
-
[11]
Marian Harbach, Emanuel von Zezschwitz, Andreas Fichtner, Alexander De Luca, and Matthew Smith. 2014. It’s a Hard Lock Life: A Field Study of Smartphone (Un)Locking Behavior and Risk Perception. In 10th Symposium On Usable Privacy and Security (SOUPS 2014). USENIX Association,...
2014
-
[12]
Ken Hinckley, Seongkook Heo, Michel Pahud, Christian Holz, Hrvoje Benko, Abigail Sellen, Richard Banks, Kenton O’Hara, Gavin Smyth, and William Buxton
-
[13]
Hassan Khan, Urs Hengartner, and Daniel Vogel. 2016. Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes. InProceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys ’16) . ACM, New York, NY, USA, 3...
2016
-
[14]
Hassan Khan, Urs Hengartner, and Daniel Vogel. 2018. Evaluating Attack and Defense Strategies for Smartphone PIN Shoulder Surfing. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems (CHI ’18). ACM, New York, NY, USA, Article 164, 10 pages. https://...
2018
-
[15]
Insu Kim, Keunwoo Park, Youngwoo Yoon, and Geehyuk Lee. 2018. Touch180: Finger Identification on Mobile Touchscreen Using Fisheye Camera and Convo- lutional Neural Network. In The 31st Annual ACM Symposium on User Interface Software and Technology Adjunct Proceedings (UIST ’18...
2018
-
[16]
Geetika Kovelamudi, Jun Zheng, and Srinivas Mukkamala. 2016. Scramble or not, that is the question a study of the security and usability of scramble keypad for PIN unlock on smartphones. In 2016 IEEE/CIC International Conference on Communications in China (ICCC) . IEEE, Chengd...
2016
-
[17]
Takuro Kuribara, Buntarou Shizuki, and Jiro Tanaka. 2014. Vibrainput: Two-step PIN Entry System Based on Vibration and Visual Information. InCHI ’14 Extended Abstracts on Human Factors in Computing Systems (CHI EA ’14) . ACM, New York, NY, USA, 2473–2478. https://doi.org/10.11...
2014
-
[18]
Taekyoung Kwon and Sarang Na. 2014. TinyLock: Affordable defense against smudge attacks on smartphone pattern lock systems. Computers and Security 42 (2014), 137 – 150. https://doi.org/10.1016/j.cose.2013.12.001
2014 doi
-
[19]
Toan Van Nguyen, Napa Sae-Bae, and Nasir Memon. 2017. DRAW-A-PIN: Au- thentication using finger-drawn PIN on touch devices. Computers & Security 66 (2017), 115 – 128. https://doi.org/10.1016/j.cose.2017.01.008
2017 doi
-
[20]
DaeHun Nyang, Hyoungshick Kim, Woojoo Lee, Sung bae Kang, Geumhwan Cho, Mun-Kyu Lee, and Aziz Mohaisen. 2018. Two-Thumbs-Up: Physical protection for PIN entry secure against recording attacks. Computers & Security 78 (2018), 1 – 15. https://doi.org/10.1016/j.cose.2018.05.012
2018 doi
-
[21]
Ilesanmi Olade, Hai-Ning Liang, and Charles Fleming. 2018. SemanticLock: An authentication method for mobile devices using semantically-linked images. CoRR abs/1806.11361 (2018)
2018 arXiv
-
[22]
Tetsuji Takada and Hideki Koike. 2003. Awase-E: Image-Based Authentication for Mobile Phones Using User’s Favorite Images. In Human-Computer Interaction with Mobile Devices and Services , Luca Chittaro (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 347–351
2003
-
[24]
Tan, Pedram Keyani, and Mary Czerwinski
Desney S. Tan, Pedram Keyani, and Mary Czerwinski. 2005. Spy-resistant Key- board: More Secure Password Entry on Public Touch Screen Displays. InProceed- ings of the 17th Australia Conference on Computer-Human Interaction: Citizens Online: Considerations for Today and the Futu...
2005
-
[25]
Emanuel von Zezschwitz, Alexander De Luca, Bruno Brunkow, and Heinrich Hussmann. 2015. SwiPIN: Fast and Secure PIN-Entry on Smartphones. In Pro- ceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems (CHI ’15) . ACM, New York, NY, USA, 1403–1406. http...
2015
-
[26]
Haijun Xia, Ricardo Jota, Benjamin McCanny, Zhe Yu, Clifton Forlines, Karan Singh, and Daniel Wigdor. 2014. Zero-latency Tapping: Using Hover Information to Predict Touch Locations and Eliminate Touchdown Latency. InProceedings of the 27th Annual ACM Symposium on User Interfac...
2014
-
[27]
Xing-Dong Yang, Tovi Grossman, Pourang Irani, and George Fitzmaurice. 2011. TouchCuts and TouchZoom: Enhanced Target Selection for Touch Displays Using Finger Proximity Sensing. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’11) . ACM, New ...
2011
-
[2010]
In Proceedings of the 4th USENIX Conference on Offensive Technologies (WOOT’10)
Smudge Attacks on Smartphone Touch Screens. In Proceedings of the 4th USENIX Conference on Offensive Technologies (WOOT’10) . USENIX Association, Berkeley, CA, USA, 1–7. http://dl.acm.org/citation.cfm?id=1925004.1925009
-
[2016]
In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (CHI ’16)
Pre-Touch Sensing for Mobile Interaction. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (CHI ’16) . ACM, New York, NY, USA, 2869–2881. https://doi.org/10.1145/2858036.2858095
2016
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.