3

enter image description here

enter image description here

These new capacitive touchpad card swipe machines have input numbers all shuffled up.

People with vision-related disabilities use the tactile dot on the number key '5' to get a sense of number placements. Which is obviously gone for the capacitive touch screens.

Is this an example of bad UX? Or is there a reason for this new numpad shuffle from a security or usability perspective?

1
  • 4
    Most likely for security reasons. If someone is watching you tap in your PIN number, they can figure out the number by your finger position on the pad. But if the numbers are mixed up, they can't do that. Nov 17 at 19:51

1 Answer 1

1

Google the feature and see what reason the vendors give for shuffling the keys. Allgood says it “helps prevent onlookers from memorising a code or pin sequence.” I guess they mean that, even if a shoulder-surfer can’t see the keypad clearly, they can make a pretty good guess of the PIN you entered on a non-shuffled keypad by observing the changing positions of part of your hand as you enter each number. If they surreptitiously videorecord your hand and study the video carefully, they might be able to guess your PIN on the first try.

Progeny Access Control says its “so that ‘tell-tale’ fingerprints do not leave clues to the access code digits.” After you enter your pin on a freshly clean keypad (“for your health and protection”), an attacker (like the shop clerk) can check the keypad for fingerprints and determine at least which numbers are in your PIN, which makes guessing easier.

This is consistent with slugolicious’s comment.

Does it hurt usability? Sure. It makes it harder to enter your PIN because you can’t rely on muscle memory. Does it improve security? Maybe, maybe not. It’s not widely appreciated that usability is security. By making PIN-entry harder, users will try to make it easier, maybe by shortening their PINs. Or they may try to avoid using it at all. Users may eschew two-factor ID as too much of a hassle, if they have the choice. If the shop clerk has to enter the PIN to unlock the POS device, they may leave it unlocked even when unattended to avoid the hassle, or increase the time-out time if they can. Shuffling the keypad makes PIN entry slower, making it easier for a shoulder-surfer to see what you’re typing if they can see the keypad. If I had to guess, I’d say on balance shuffling increases security in most cases, but there may be cases where it actually decreases security when deployed in the real world.

As for accessibility, I’d guess shuffling ruins it, but I’m unclear how a blind person uses a touchscreen virtual keypad in any case. Physical keypads are more usable than virtual keypads whether users have a disability or not since the tactile feedback makes entry easier.

2
  • Thank you for the detailed answer! I too believe that the apparent security you might achieve from the shuffling is only good on paper. Unless there is research on this that prove otherwise.
    – Sooraj MV
    Nov 22 at 19:31
  • And I agree with the fact that the physical keypads are good for accessibility compared to touch screens, and may be a better option for reducing carbon footprint.
    – Sooraj MV
    Nov 22 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.