Reasons why I don't think PIN scrambling is useful

gk7ncklxlts99w1

Years ago I made a post about this. I can't seem to find it. I thought I would revive that discussion.

The majority of responses, I recall, were largely in favour of pin scrambling. Here's why I don't think PIN scrambling has any practical use, at all, for any situation:

It increases pin input time significantly, especially when your PIN is longer, 8+. At least for me.
Only useful against shoulder-surfing attacks (or CCTV). As such, you would only use it on a profile you use while in public, or in a workplace / study environment.
If you utilize multiple profiles, it is likely (I'm assuming) that your public profile isn't as sensitive as Owner or a main profile. Certainly in my case.
Importantly: Because you are typing much more slowly, assuming the adversary is a human watching you with eyes, and not a camera, I believe it would be easier and not harder to see what numbers they've entered, if you have a clear sight of the phone screen.
Perhaps most importantly: A camera that has a clear sight of your screen can see the numbers. In comparison to the standard layout, where your fingers would be moving too quickly. CCTV does not have a good refresh rate. It would all be a blur if you used a standard layout.
Less of a reason to use it on 2FA PIN with biometric unlock. Because the 2FA pin is the one you expect to use more frequently, hence for convenience, but you throw that out when you're using a scrambled layout. It would be infuriating for me.

What are your thoughts?

Johnnyloans

gk7ncklxlts99w1 Only useful against shoulder-surfing attacks (or CCTV)

A high quality security camera could be 12 meters (40ft) away and read your texts crystal clear on the phone.

gk7ncklxlts99w1

Johnnyloans I think that's a stretch, and certainly not possible if you're moving even a bit.

https://youtu.be/0LvcJ78lFnM

I'd say you'd need to be perfectly still, with full brightness screen and in day light, within 10 feet.

This one might do a better job, but who's using these? Probably no one. https://youtu.be/FRL9N-A-BnA

BRNko

Johnnyloans You have to realize that reality isn't what you see in fancy movies. Just for curiosity I tested how cameras can see with almost impossible conditions for CCTV. This screenshot is from 4k video made by Pixel 8 Pro which is better than almost any CCTV. Even when CCTV's sensor has same quality, the bitrate is way lower. Conditions: No movement, distance 270 cm, lot of light in room, display set to full brightness, phone exactly upright to camera (impossible in real world). This phone on picture is at distance where numbers on pad is just starting to be recognized by human. I can recognize 3-4 characters. Any of this single condition change will do damage to view: longer distance than 270 cm, lower brightness of screen, movement, any different angle, reflections, lower camera sensor, lower bitrate than phone's, not to mention of combinations of that. That distance from camera is like camera is right at your back. Any more distance, you're safe. However camera still can distinguish your finger tap pattern on way longer distances where pin pad scrambling comes in.

Johnnyloans

gk7ncklxlts99w1

Satellites can read books through the haze of the atmosphere.

Realtors all across the USA have these cameras in their buildings.

Optical zoom is crazy. See a person doing jumping jacks miles away.

-youtube link:
Higher FOV is inversely related to fine detail. This is the worst camera to see details.

BRNko

People can remember numbers as well as patterns used. When pin is long and random like, it's very hard to remember 10 digit for example. Pattern remember is impossible by scrambling it. You can do 2FA with 4 digit pin and keep that big one as master. Also cameras often don't have resolution to see characters on screen. And yes... smaller characters on pin pad would be nice if user can adjust that. I suffered with same thing as you... very slow pin entering but for several months I used to 2 things. I have much more trained eye to fast look for numbers and second is to enter the pin as more batches. Let's say pin have 10 digit. You look for 4 first digits, then enter them quickly, then seek for another four and so on. Someone that look at you will have hard time to read fast pin entrance. It's not impossible, but way harder that if you look for one digit and press it. My opinion.

gk7ncklxlts99w1

BRNko

these are your arguments:

people can remember patterns as well as numbers

Yes, but in my opinion, it is a lot easier to remember numbers, especially so when they are typed slowly, but a camera doesn't need to remember anything, it just needs to see the numbers + the entry pattern, which requires sufficient resolution + refresh rate.

longer pin is harder to remember

True, but easier to remember when typed slowly.

Cameras don't have high enough resolution

Depends on a variety of factors, and in most situations I'd agree the camera won't be able to see it. But that just bolsters my argument. If cameras can't see you then why are you scrambling your layout?

You look for 4 first digits, then enter them quickly, then seek for another four and so on

Eh, I doubt it would make enough of a difference to make scrambling worth it.

gk7ncklxlts99w1

Johnnyloans

Satellites can read books through the haze of the atmosphere.

Even if that were true (I'll assume it is), Satellites are not the same as CCTV and realtors certainly aren't using that tech.

Please show me a youtube video where realtors are using satellite CCTV to read books and maybe I'll believe you.

Higher FOV is inversely related to fine detail. This is the worst camera to see details.

Show me a better video?

BRNko Randomized PINs are a given. If you're using a predictable pattern then it doesn't really matter whether you scramble your pin or not.

BRNko

Also anyone paranoid should have 10 digit, non repeating digits in pin. Because when camera sees entering pin 18281848, then someone has to decode only 4 numbers even you have 8 digit one. Less than 10 digits is less secure and more is not more secured because of repeating taps on same place.

guser39

BRNko non repeating digits in pin

Repeating numbers is actually safer/stronger than having no repeating numbers.

Consider your ten-digit PIN example. Strictly from a permutation standpoint, you significantly shrink the possible permutations if you do not repeat numbers.

permutations of 0-9 ten times with no replacement: 10!/(10-10)! = 3,628,800
permutations of 0-9 ten times with replacement: 10^10 (much greater than 10p10)

Assuming that an adversary doesn't already have a perfect video capture of you entering your PIN then they are left with knowing they need to guess or attempt a PIN with limited (or no knowledge) of which numbers repeat. So, they may be forced to attempt PINs including a number you never actually use (e.g., maybe you never use 3 but they couldn't quite make that out from their view/recording).

Smaller permutations example of a four digit PIN:

permutations of 0-9 four times with no replacement: 10!/(10-4)! = 5,040
permutations of 0-9 four times with replacement: 10^4 = 10,000

Johnnyloans

BRNko You have to realize that reality isn't what you see in fancy movies.

lmao

4k video made by Pixel 8 Pro which is better than almost any CCTV.

Better than what, Temu security cameras? Your P8P is comparable to a $400 entry-level camera that I'd give to a 14 year old to be rough on.
There's a huge difference between consumer CCTV and what companies buy.
4k means nothing
200 Megapixels on the Samsung galaxy S26 ultra proves useless in a head-on camera battle.

Plenty of 30MP DSLRs or mirrorless cameras blow your P8P and the S26 ultra out of the water.

Do you know how much more detail we can pack into 2 degrees of view compared to your 22°FOV telephoto lens?

If the MP are the same, roughly (22/2)² = 121 times more detail. This Axis camera has 1/6th the MP, so for every 1 pixel your P8P shows, this camera fits 20 pixels for massively increased detail.
https://www.axis.com/products/axis-q6358-le
Axis, the gold standard $3,000+ camera.

Campuses with CCTV have viewing computers with 24Cores/48thread CPUs and a $1,000-$2,000 GPU for their glorified youtube machine.
This isn't your neighbor's $30 intel 7500 igpu, hikvision, blue iris set-up

the bitrate is way lower.

A useless metric. Phone mbps is grossly inflated and inefficient because phones are underpowered for better real-time encoding. I could re-encode a phone recording--using the same codec--with 30-40% less bitrate and retain the same quality. Conversely, I could re-encode a video to be 50x larger, same quality.

[perfect recording conditions]

I've seen with my own eyes what these expensive cameras can do under worse conditions.
Your P8P probably exhausted the 5x optical zoom and started digitally zooming in--making the blurriness plain. The Axis has 30x optical zoom i believe and up to double your lens size.

BRNko

guser39 I'm sorry, I admit that my message wasn't very clear, but you missed my point. You have right and I agree, but your calculations assume that nobody is looking. My assumption counting with, for example, CCTV captured my pin entrance, without seeing actual numbers. Attacker will have captured only the position where I tapped while entering pin on scrambled pad. Extremely simplified is to have 10 digit pin code like 0555050000. That mean attacker see those positions and on scrambled pad he knows that your pin code uses only 2 digits. So it can brute-force pins in this way:
0111010000
0222020000
0333030000
0444040000
0555050000 - bingo!

So possibilities is 2¹⁰ = only 100
4¹⁰ when used 4 repeating numbers regardless of pin length and so on.
But in my case with only non repeating numbers, there is brute-force possibilities D! where 'D' is number of digits count, and where 'D' can't be larger than 10 because PIN with 11 digits surely have repetitions.

So yes, my 10 digit non-repeating pin code will have 10! = 3,628,800 possibilities, which is the maximum possible combinations in case someone record your finger positions while pin entrance.

@Johnnyloans my point was in "better than almost any CCTV". I didn't said all of them. Almost any - meant all CCTV cameras used randomly everywhere in the world. Not everyone live and work in NSA building where is one camera to one person zoomed constantly at person's phone. Depends on thread model. My assumption was accidental recorded pin entrance. Not when NSA trying to. Usually cameras is placed at top, not having optical zoom, not having massive resolutions and with wide field of view to cover the most space. Those cameras is used almost everywhere. Stores, gas stations, office buildings and so on.

The-Man

whether you use the Hubble telescope or not to view pin numbers successfully, the use of scrambled pin pad is a personal choice. I don't use it.
I use a 16 digit pin and reduced animation on the screen. The default is a fancy rotating icon displayed for every successful input. So, as an adversary, I watch the icons, and after several covert viewings, I know my target uses an X length pin. Then I concentrate on the first 8 pin numbers, successfully get them then concentrate on the last numbers, get them, then I am ready to strike. One final watch to make sure the pin is not changed and away we go...
So back to my reduced animation input pin, no fancy rotating icon for every inputted number, just a dot. After 10 inputs the dots have filled the screen. Now because of the reduced animation any input over 10 inputs, the dots don't seem move, it always show 10 dots even though my pin is 16 digits long, two of my over 10 pin inputs are repeated numbers and the double tap is quick due to muscle memory.
Now I know this isn't perfect but enough to confuse, for a while at least.
Oh and another thing.... no biometric unlock, and I use either 10 minute or 30 minute auto unlock, depending if I am inside or outside.

Johnnyloans

BRNko my point was in "better than almost any CCTV". I didn't said all of them.

No one trusts what they buy to roulette--certainly not companies. If there are 1 billion more entry level phone models, the % chance of you--or a billion dollar organization--having an entry level phone doesn't increase.

Not everyone live and work in NSA building where is one camera to one person zoomed constantly at person's phone.

Every supermarket in the USA, and many other countries, isn't exactly the NSA. A place 75% of people go isn't rare.
75% & 0.0000001% aren't close to comparable.
The camera certainly is zoomed directly on people's phones communicating about theft or their hands/bag.

My assumption was accidental recorded pin entrance.

Your threat model includes adversaries tripping over themselves into success?

Weird straw mans which certainly don't align with your original position of the impossibility of such a task.

Cheers mate.

The-Man

BRNko My assumption counting with, for example, CCTV captured my pin entrance, without seeing actual numbers

the other large assumptions on your behalf are;
the camera is it powered on, is it in focus, is the lens clean, if its WiFi, is it connected, is it online, is it raining on the lens is wind oscillating the camera, is the sun causing lens flare etc, then is a person actually on the viewing end of the camera, if not is it recorded, the media it records on is it a 4 year old 7200 rpm HDD that is worn out or even worse a VHS cassette. And the list goes on... so there is a camera, big deal, assume it might get your pin, but the reality is, it wont... Unless your adversary placed that very high speed, perfectly focused high resolution, infra-red, comparison FLIR camera at your phone, the instant you typed...

edit: forgot colour night vision camera.....