4:42 p.m. | Updated Noting the $19.90 annual subscription fee that comes with WaveSecure app, now owned by McAfee.
4:42 p.m. | Updated In the 2002 video game Splinter Cell, players used thermal goggles to discern fingerprints on security keypads, giving away their passwords.
Instead of using numeric passwords, Android’s basic security uses a grid of nine points, unlocked with the multipoint swipe gesture of your choosing. These gestures leave a smudge pattern that, under ideal conditions, can be guessed in total 68 percent of the time, and partly 92 percent of the time, the researchers said.
To decipher the gestures, researchers snapped photos of HTC’s G1 and Nexus One phones under a few different kinds of lighting. They then used photo-editing software to bolster contrast and brightness. Passcodes were easiest to guess from their smudge marks when the user had swiped after holding the phone to his or her oily cheek, a common occurrence given that the phone locks during lengthy conversations. Even after simulating the swipes and taps of normal phone use, researchers were able to guess passcodes correctly, because the pattern for password entry is so distinct compared with other uses.
The researchers used professional cameras, lighting and photo editing software to reveal the passcodes, but they said less elaborate setups would work just as well. Basically, all a hacker needs is a decent camera, some directional lighting and any editing software that can adjust image brightness and contrast.
Before you get too paranoid, consider a few points: Entering a passcode with gentle swipes drastically reduced the odds of successful guessing, and a light wipe on the pants before putting the phone in your pocket can help obscure the swipe pattern as well.
Adam Aviv, a computer science doctoral candidate who wrote the study with Katherine Gibson and Evan Mossop, said in an interview that the only cure was a different password protection system. Phones that run Android 2.2, the latest version, can use a PIN or alphanumeric password instead of gestures, and are harder to recognize. Otherwise, Mr. Aviv said users should simply be aware that swiping can leave behind residual information.
Still nervous? Try WaveSecure, an Android app (it carries a subscription fee) that lets you lock down the phone, erase its data or locate it remotely from any computer if the phone is stolen. You might even find the hacker’s secret smudge-detecting photography lab in the process. As for thwarting government spies equipped with thermal goggles, I’m all out of suggestions.