Why aren’t Users Using Protection? Investigating the Usability of Smartphone Locking Nicholas Micallef*, Mike Just^, Lynne Baillie^, Martin Halvey + , Hilmi Güne? Kayacik ? * Glasgow Caledonian University, Glasgow, UK, nicholas.micallef@gcu.ac.uk^ Heriot-Watt University, Edinburgh, UK, {m.just, l.baillie}@hw.ac.uk+ University of Strathclyde, Glasgow, UK, martin.halvey@strath.ac.uk? FICO, 181 Metro Dr. San Jose CA, guneskayacik@fico.com high importance to security adopt locking mechanisms but still feel annoyed when using them. This leads to two usability problems: efficiency and satisfaction. Attempts to improve smartphone authentication have typically considered alternative mechanisms, such as graphics [3], touch biometrics [12,20] and gestures [13,18], though such solutions have not adequately addressed efficiency and satisfaction [19]. To date context-dependent solutions [6,9] have relied upon location sensors alone for determining when to require an explicit unlock with a locking mechanism. Using location alone, however, introduces insider attacks (attacks carried out by people who have unrestricted access to a victim’s space), which are increasingly becoming a major concern for users [5,16]. In our approach we augment location sensors with environment-related sensors (i.e., noise, light, magnetic field and accelerometer) to characterize the environmental surroundings of the smartphone. For example, only when the phone detects a change in environmental surroundings (e.g., different noise levels due to having friends over) would the phone ask for explicit unlocking. This adds an extra layer of security against insider attacks over location sensors only solutions. Thus, a context-dependent solution that uses location with environment sensors has two aims (1) to increase efficiency by reducing the instances in whichusers need to enter an explicit unlocking mechanism to onlythose in which the changes in the usage pattern andenvironment make it necessary to input a PIN/pattern, (2) toimprove security for those users who currently do not locktheir phone while maintaining a reasonable level of securityfor those users who currently lock their phone. Therefore,we hypothesize that this type of solution could increase useamong traditional non-adopters (users who do not lock theirphone), and reduce the level of annoyance to currentadopters, whilst still providing an acceptable level ofconvenience and security.Thus, we designed and implemented a context-sensitive screen locking application and then evaluated its adoption using a 3-phase user study. We began by constructing an environment profile (Phase I) using 1 week of sensor data [11]. In the second week (Phase II) the application changes from passive data collection and analysis to an active screen locking mechanism which determines when to prompt the participants for a PIN/pattern depending upon the match of ABSTRACT One of the main reasons why smartphone users do not adopt screen locking mechanisms is due to the inefficiency of entering a PIN/pattern each time they use their phone. To address this problem we designed a context-sensitive screen locking application which asked participants to enter a PIN/pattern only when necessary, and evaluated its impact on efficiency and satisfaction. Both groups of participants, who prior to the study either locked or did not lock their phone, adopted our application and felt that unlocking their phone only when necessary was more efficient, did not annoy them and offered a reasonable level of security. Participants responded positively to the option of choosing when a PIN/pattern is required in different contexts. Therefore, we recommend that designers of smartphone locking mechanisms should consider ceding a reasonable level of control over security settings to users to increase adoption and convenience, while keeping smartphones reasonably secure. Author Keywords Usability; Mobile HCI; User Experience; Adoption; Authentication ACM Classification Keywords H.5.2. Information interfaces and presentation: UserInterfaces – Input devices and strategies, evaluation.INTRODUCTION Current smartphone screen locking mechanisms are not as efficient as they could be because every time a user wishes to use their phone (e.g. make a call, open an app etc.) they need to enter a PIN, pattern or password. This additional step may be the reason why 64% of smartphone users do not lock their phones [4]. Of the users that do use a locking mechanism, 40-47% find it “annoying” [5,8,10]. This suggests that users who regard convenience to be important do not adopt locking mechanisms and those users who give Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Permissions@acm.org. MobileHCI '15, August 24 - 27, 2015, Copenhagen, Denmark© 2015 ACM. ISBN 978-1-4503-3652-9/15/08…$15.00 DOI: http://dx.doi.org/10.1145/2785830.2785835Authentication MobileHCI'15, August 24–27, Copenhagen, Denmark284
