People should stop using patterns to unlock their devices, researchers have warned. A new study has found that it's a lot easier for people who might be looking over your shoulder as you unlock your phone to memorise a pattern than a passcode. So-called "shoulder surfing attacks" can be easy for a criminal to plan and execute, but you can protect yourself by switching to a PIN code and increasing its length from four digits to six, the researchers say. They got over 1,000 volunteers to act as attackers, challenging them to memorise a range of unlocking authentications – four- and six-digit PINs, and four- and six-length pa tterns with and without tracing lines – by watching a victim over their shoulder from a variety of angles. The 5-inch Nexus 5 and 6-inch OnePlus One were the two handsets used in the study, as the researchers say they "are similar to a wide variety of displays and form factors available on the market today, for both Android and iPhone".

Smartphones today compete over which can best secure your secrets. They encrypt your data, store the digital keys to unlock themselves on specialized hardware, and even offer fancy biometrics from fingerprints to faceprints. But many millions of smartphones remain open to an absurdly low-tech attack: a sly glance at someone's phone while they unlock it. One new study has quantified just how easy an Android-style unlock pattern--as opposed to a six-digit PIN or biometric unlock--makes the job of any over-the-shoulder snoop. Security researchers at the US Naval Academy and the University of Maryland this week published a study that shows that a casual observer can visually pick up and then reproduce an Android unlock pattern with relative ease. In their tests, they found that six-point Android unlock patterns can be recreated by about two out of three observers who see it performed from five or six feet away after a single viewing.