OneButton PIN
A research-driven authentication concept for blind and low-vision users that rethinks PIN entry from first principles. Instead of incrementally improving the existing keypad, I explored a more strategic question: can a different interaction model reduce motor friction, improve privacy, and make observation-based attacks harder?
The result was a single-tile haptic PIN method that won the Best Paper Award at MobileHCI 2022 and was evaluated across both usability and attack-resistance dimensions.
😖 The problem
Standard PIN entry assumes visual targeting, spatial navigation, and low-risk environments. For blind and low-vision users, those assumptions break fast. Small targets are error-prone. Screen-reader support can expose digits aloud. Finger movement across a keypad creates observable patterns in public.
✨ The concept
Replace the 0–9 keypad with a single large interaction target. The user presses and holds, feels a rhythm of haptics, counts the pulses, and releases to enter the digit. Timing can be randomized to reduce predictability and make observation harder.
🎚️ Experimental controls
🧠 Research framing and concept strategy
This project is stronger than a typical accessibility case study because it did not treat the problem as a UI polish exercise. I approached it as a strategic research question: what interaction model best serves users when accessibility, privacy, and security are all critical at the same time?
That framing changed the work. Instead of optimizing an existing keypad, I reframed the problem around human behavior, observable signals, haptic perception, and public-use risk. That made the solution space more ambitious and more meaningful.
- User constraint: blind and low-vision users need reduced motor complexity.
- Context constraint: PIN entry often happens in public or semi-public environments.
- System constraint: feedback has to be legible without leaking sensitive information.
- It removes spatial target selection entirely.
- It turns digit entry into a count-and-release interaction.
- It uses timing variability as a deliberate part of the security strategy.
- Digit entry: hold → feel pulses → count → release → digit entered.
- Wrap behavior: after 9, the counter restarts at 0.
- Zero entry: quick tap before vibrations start, or deliberate count strategy depending on configuration.
- Threat-aware design: timing variability can add ambiguity for observers.
🧪 Evaluation strategy
I did not want this to be a speculative concept with no evidence. The evaluation strategy was designed to answer both usability and attack-resistance questions, because the concept only matters if it performs on both dimensions.
- Participants: 9 blind and low-vision users.
- Goal: understand learnability, accessibility, and practical usability over repeated use.
- Measures: speed, accuracy, and workload across conditions.
- Participants: 10 sighted observers.
- Goal: test whether reduced motion and randomized timing weakened shoulder-surfing success.
- Outcome focus: not just “can users do it,” but “does it shift the risk profile.”
- OBP (default settings)
- RVI (random VI increase)
- RST (random ST)
- RVIST (random VI + ST)
- TRAD (traditional keypad baseline)
- I prefer evaluation structures that compare tradeoffs rather than validate one favorite design.
- I use constraints and conditions to create decision-worthy evidence, not just descriptive findings.
✅ Why this aligns with strategic UX research roles
This project is relevant because it shows the exact behaviors strong strategic researchers need: reframing the problem before others see it, working across technical and human constraints, and producing evidence that guides direction rather than just describing pain points.
- I started with an unclear problem space where accessibility and security goals were in tension.
- I clarified the decision space before committing to the concept.
- The work considered user behavior, feedback channels, device capabilities, and adversarial observation together.
- The solution was designed as a system, not a screen.
- The concept was supported by longitudinal diary research and experimental security testing.
- This balanced human perception with measurable performance and risk.
- The output is not just “insight.” It points to where the concept is promising, where it needs hardening, and what should be tested next.
🔭 What I’d do next
- Native implementation: move beyond browser limitations and test platform-level haptics and accessibility APIs.
- Calibration flow: let users personalize interval and duration based on sensitivity and device hardware.
- Broader scenario testing: evaluate one-handed use, interrupted sessions, low-battery conditions, and real public environments.
- Advanced threat modeling: test against high-speed video timing analysis and stronger observation strategies.
- Production framing: explore whether this belongs as a fallback authentication mode, accessibility option, or broader secure-entry pattern.