Duress Unlock: Using Covert Signals to Restrict Access to Mobile Devices

An unlocked mobile device can be a treasure trove of private information. Adversaries that are socially close to the user are in a particularly favorable position to authentication code and can even be handed the device for a legitimate task. To address this threat, we propose a new authentication concept that assumes that, by default, a user is authenticating under duress. An inconspicuous side-channel interaction with the device at authentication time dictates whether it grants regular access or enters a secure mode. This paper explores how systems based on this concept can help coping with shoulder-surfing while also allowing for impromptu device sharing