Management Development Program

Is Bigger Better? Comparing User Generated Passwords on
3×3 vs. 4×4 Grid Sizes for Android’s Pattern Unlock

Adam Aviv, USNA

1:00-2:00pm Tuesday, 1 December 2015, ITE 459

Android’s graphical authentication mechanism requires users to unlock their devices by “drawing” a pattern that connects a sequence of contact points arranged in a 3×3 grid. Prior studies have shown that human-generated patterns are far less complex than one would desire; large portions can be trivially guessed with sufficient training. Custom modifications to Android, such as CyanogenMod, offer ways to increase the grid size beyond 3×3, and in this paper we ask the question: Does increasing the grid size increase the security of human-generated patterns?

To answer this question, we conducted two large studies, one in-lab and one online, collecting 934 total 3×3 patterns and 504 4×4 patterns. Analysis shows that for both 3×3 and 4×4 patterns, there is a high incidence of repeated patterns and symmetric pairs (patterns that derive from others based on a sequence of flips and rotations). Further, many of the 4×4 patterns are similar versions of 3×3 patterns distributed over the larger grid space. Leveraging this information, we developed the most advanced guessing algorithm in this space, and we find that guessing the first 20% (0.2) of patterns for both 3×3 and 4×4 can be done as efficiently as guessing a random 2-digit PIN. Guessing larger portions of 4×4 patterns (0.5), however, requires 2-bits more entropy than guessing the same ratio of 3×3 patterns, but the entropy is still on the order of cracking random 3-digit PINs. These results suggest that while there may be some benefit to expanding the grid size to 4×4, the majority of patterns will remain trivially guessable and insecure against broad guessing attacks.

Adam J. Aviv is an Assistant Professor of Computer Science at the United States Naval Academy, receiving his Ph.D. from the University of Pennsylvania under the advisement of Jonathan Smith and Matt Blaze. He has varied research interests including in system and network security, applied cryptography, smartphone security, and more recently in the area of usable security with a focus on mobile devices.

The Summer Institute in Biomedical Informatics offers an intensive internship that includes classes, research projects and training in technical communication.  Classes with clinical researchers meet twice a week; the mentored research projects, carried out under the supervision of investigators at Harvard Medical School (HMS), the Harvard teaching hospitals and MIT, may, and often do, result in refereed publications. The labs are located in various HMS sites, including Children's Hospital and the Brigham and Women's Hospital.  Please note that this is a research-oriented program for students who aspire to a career involving research in genetics/genomics and/or bioinformatics/computer science and related disciplines. Our partner for the program is the Department of Biomedical Informatics (DBMI) at HMS.  Contact this program by email at bigsummer@mit.edu.  Application Deadline: Saturday, January 30, 2016.

The MGH Summer Institute in Biomedical Optics is run by the Wellman Center for Photomedicine at Massachusetts General Hospital (MGH). During the summer, students attend the Biomedical Optics Lecture Series, work on a specific project in a lab at the main campus of MGH or at MIT, and receive additional training in technical communications and responsible conduct of research. The mentors in this program are academically demanding; they are looking for students with strong engineering, physics and biology backgrounds. This program may be contacted by email to BioOpticsSummerInstitute@mgh.harvard.edu. Applications must be postmarked by: Friday, January 15, 2016.

We are looking for a combination of academic excellence and diversity in our summer students. Underrepresented minority students are encouraged to apply.  The lab descriptions on the website state more specific requirements for Biomedical Optics. In the Bioinformatics program, students will be matched with a lab based on their stated interests and dialogue with the program director. 

While the idea of a joint program at both Harvard and MIT may be intimidating to some students, please know that lab mentors are aware that undergraduates are not post-docs, and that their job as mentors is to encourage, not dissuade, students from pursuing research.  Boston is a lovely place to be in the summer with our long days and ideal climate, and a big part of our job is to make sure students have fun, meet lots of people, and feel well cared for. Students in both programs also receive a stipend for the summer.

Complete applications for both programs include an application form, official transcripts from undergraduate institutions attended, and two letters of recommendation.

Note: Students are required to attend the entire nine weeks (with rare exceptions made when school schedules or presentation opportunities are an issue), and must be U.S. citizens or permanent residents. Housing is provided on the MIT campus.

UMBC Department of Information Systems

Is Bigger Better? Comparing User Generated Passwords on
3×3 vs. 4×4 Grid Sizes for Android’s Pattern Unlock

Adam Aviv, USNA

1:00-2:00pm Tuesday, 1 December 2015, ITE 459

Android’s graphical authentication mechanism requires users to unlock their devices by “drawing” a pattern that connects a sequence of contact points arranged in a 3×3 grid. Prior studies have shown that human-generated patterns are far less complex than one would desire; large portions can be trivially guessed with sufficient training. Custom modifications to Android, such as CyanogenMod, offer ways to increase the grid size beyond 3×3, and in this paper we ask the question: Does increasing the grid size increase the security of human-generated patterns?

To answer this question, we conducted two large studies, one in-lab and one online, collecting 934 total 3×3 patterns and 504 4×4 patterns. Analysis shows that for both 3×3 and 4×4 patterns, there is a high incidence of repeated patterns and symmetric pairs (patterns that derive from others based on a sequence of flips and rotations). Further, many of the 4×4 patterns are similar versions of 3×3 patterns distributed over the larger grid space. Leveraging this information, we developed the most advanced guessing algorithm in this space, and we find that guessing the first 20% (0.2) of patterns for both 3×3 and 4×4 can be done as efficiently as guessing a random 2-digit PIN. Guessing larger portions of 4×4 patterns (0.5), however, requires 2-bits more entropy than guessing the same ratio of 3×3 patterns, but the entropy is still on the order of cracking random 3-digit PINs. These results suggest that while there may be some benefit to expanding the grid size to 4×4, the majority of patterns will remain trivially guessable and insecure against broad guessing attacks.

Adam J. Aviv is an Assistant Professor of Computer Science at the United States Naval Academy, receiving his Ph.D. from the University of Pennsylvania under the advisement of Jonathan Smith and Matt Blaze. He has varied research interests including in system and network security, applied cryptography, smartphone security, and more recently in the area of usable security with a focus on mobile devices.

UMBC Department of Information Systems

Is Bigger Better? Comparing User Generated Passwords on
3×3 vs. 4×4 Grid Sizes for Android’s Pattern Unlock

Adam Aviv, USNA

1:00-2:00pm Tuesday, 1 December 2015, ITE 459

Android’s graphical authentication mechanism requires users to unlock their devices by “drawing” a pattern that connects a sequence of contact points arranged in a 3×3 grid. Prior studies have shown that human-generated patterns are far less complex than one would desire; large portions can be trivially guessed with sufficient training. Custom modifications to Android, such as CyanogenMod, offer ways to increase the grid size beyond 3×3, and in this paper we ask the question: Does increasing the grid size increase the security of human-generated patterns?

To answer this question, we conducted two large studies, one in-lab and one online, collecting 934 total 3×3 patterns and 504 4×4 patterns. Analysis shows that for both 3×3 and 4×4 patterns, there is a high incidence of repeated patterns and symmetric pairs (patterns that derive from others based on a sequence of flips and rotations). Further, many of the 4×4 patterns are similar versions of 3×3 patterns distributed over the larger grid space. Leveraging this information, we developed the most advanced guessing algorithm in this space, and we find that guessing the first 20% (0.2) of patterns for both 3×3 and 4×4 can be done as efficiently as guessing a random 2-digit PIN. Guessing larger portions of 4×4 patterns (0.5), however, requires 2-bits more entropy than guessing the same ratio of 3×3 patterns, but the entropy is still on the order of cracking random 3-digit PINs. These results suggest that while there may be some benefit to expanding the grid size to 4×4, the majority of patterns will remain trivially guessable and insecure against broad guessing attacks.

Adam J. Aviv is an Assistant Professor of Computer Science at the United States Naval Academy, receiving his Ph.D. from the University of Pennsylvania under the advisement of Jonathan Smith and Matt Blaze. He has varied research interests including in system and network security, applied cryptography, smartphone security, and more recently in the area of usable security with a focus on mobile devices.

UMBC students Damola Adediran ‘17, computer science, and Sarah Kirby ‘16, computer science, were members of a standout team at the 2015 HackDC Hackathon that won top prize in the “Best Mobile Application for Clinicians” category, for their app “myBivy.”

This year’s HackDC Hackathon challenged competitors to build a mobile app to help veterans with post-traumatic stress disorder (PTSD) deal with insomnia, which is common within this population.

The myBivy app tracks veteran’s heartbeat and movements to detect night terrors, and over time works to help prevent them. The app allows veterans to observe their sleep patterns and to share the data collected overnight with their doctor.

The 36-hour-long Hackathon, held September 25-27, gave teams a chance to work on developing their apps by collaborating with clinicians, veterans, and veterans’ families and friends, who offered feedback on what information the veterans want to track.

Adediran’s job on his team was to communicate with clinicians about how the app would best serve the veterans, and to debug the app throughout the development phase.This was Adediran’s second Hackathon, and he says it was extremely empowering. He describes it as, “something I’ve never experienced before.”

In addition to a cash prize, the team will use funds collected on their Kickstarter page to develop, test and launch the myBivy app by the spring of 2016. For more information about the myBivy app and team, visit the Kickstarter page.