Randomized pads sacrifice touch-typing speed; that is a security–efficiency tradeoff

What it is

Once digit positions are scrambled, muscle memory for a telephone or calculator pad no longer works; every key must be looked at then tapped. PIN time rises clearly, and neighbor errors rise when people hurry. That is an efficiency tax paid to reduce position-based shoulder surfing. It is not randomization failing; it is the design cost. The tradeoff has to be explicit: pay it where shoulder-surf risk is high; paying the same tax for a four-digit unlock at home is often not worth it.

Why it happens

Touch typing encodes digits as relative coordinates. A per-session map voids that program and visual search takes over. Search cost grows with key count: ten digits already require a scan; scrambling letters as well is close to unusable. People in a queue under time pressure revert to “around there,” errors rise, and the PIN may land in screen logs or lockout counters. Fixed layouts are fast and reconstructible from coordinates; random layouts are slow and coordinates are meaningless. Neither dominates; it is a function of scene.

Studying it

Have the same people enter the same PIN on fixed and random pads; record time, glance count, errors, and bystander recovery, and plot security gain against efficiency cost. Pressure (time limit, someone standing behind) should be a separate condition. Diaries show whether a random pad ever becomes memorable over weeks—usually not, because the map changes every time. Do not replace recovery rate with a “feels safer” questionnaire.

Where it stops holding

Jittering keys in a small neighborhood rather than a full permutation lowers the tax and the protection. Hardware PIN pads with nubs cannot randomize, so efficiency is kept. If paste or biometrics are allowed, the random pad is only a fallback and the tax is paid only then. Users with low vision pay a higher tax than the mean; the tradeoff must count them.

Applying it

• Default to random on public-transit and counter products; offer a fixed layout for personal-device unlock, with a shoulder-surf warning.
• Make biometrics or the system password vault the primary path so the random pad appears only on failure, lowering how often the tax is paid.
• Do not put a random pad on long passphrases or a main password that must be typed often.
• Verify by measuring median entry time and bystander recovery, showing both columns to the decision owner, and writing down which end of the trade they accept.

Related

• Same group: C6.29.1 Some systems pop a randomized number pad on password fields to block position-based shoulder surfing · C6.29.2 Password keyboards usually turn off autocorrect and candidates so input is not leaked · C6.29.4 Password fields should not use third-party IMEs' cloud candidate services, which can leak plaintext
• Adjacent: C6.19 Touch typing and homing references · C6.23 Numeric keypad layout differences
• Search: security usability tradeoff · PIN entry time · randomized keypad