Lock-screen surfaces need a privacy pass

What it is

The lock screen is visible before authentication: a lit phone on a desk, a raised wrist on a commute, an always-on clock on a meeting table. Widgets, notification previews, and standby faces all speak on that surface, which means they speak to whoever is around before unlock. An SMS one-time code, a calendar title “layoff conversation with HR,” a delivery address, the last line of a chat are reasonable inside the unlocked app and an exposure on the lock screen. This entry is only about who can see before unlock. It is not about whether a widget is glanceable, and not about how many steps a tap can finish.

Why it happens

The lock screen’s viewer is not necessarily the owner. Authentication has not happened, yet content is already lit—and on always-on displays, no one even has to touch. Notification previews, by default, push a sender and a line of body onto that surface; a lock-screen widget is more persistent, so a meeting title stays lit for the whole idle. People imagine the threat as “a stranger picks up the phone”; more often it is a shoulder, a photograph, a screen lying face-up in a meeting. The system offers switches such as hide-preview-until-unlock, but the switch is the user’s and the payload is the app’s. Writing sensitive fields into a lock-visible payload and leaving users to kill the whole notification channel pushes the duty onto the shade. Once visibility holds, encryption and permission models do not help—the information is already on the glass.

Studying it

Run shoulder-surfing and passer-by observation: at a fixed distance and angle, a second person reads the lock screen and lists identities, events, messages, addresses, and codes they can recover. Compare hide-preview versus show-preview, and presence versus absence of a lock-screen widget.

Independent variables: preview policy, always-on, sensitivity of the content, viewing distance and angle, lock-screen widget present. Dependent variables: sensitive fields recovered by the second person, owner discomfort, willingness to change preview settings.

Lab “observers” are recruited to perform a task, so detection sits above a casual passer-by and below a deliberate photograph. Do not stop at “do you care about privacy”—attitude and the fields still lit on the lock screen often disagree. If other people’s lock screens cannot be photographed in the field, an inventory of the owner’s own lock-screen photo still counts visible fields.

Where it stops holding

A phone used only on a private nightstand has little shoulder-surfing risk; the owner may choose to show previews always. A work phone whose MDM forces hidden previews still benefits from an app-side red line, so a policy change does not suddenly undress the payload. Screencast and screen sharing are another exposure path, with viewers not even in the room. Weather, battery, and the next bus on the lock screen are low-identity and usually do not need medical-record treatment. A user who explicitly turns on “always show previews” is making an informed choice; the app should still not post a one-time code there.

Applying it

• Write a separate string for lock-screen surfaces: drop body, names, addresses, and codes; leave an actionable class (“a new message,” “your trip updated”).
• Default lock-screen widgets to aggregates or blur: the next meeting as “2pm meeting,” not the client name; finance as direction of change, not a balance.
• Do not emit one-time passwords, medical detail, or live location as lock-visible fields.
• Verify by photographing the lock screen from a metre away, including always-on. List every personally identifying or confidential string in the photo. Each should be reducible to a class or removed; what cannot be reduced should not appear on this unauthenticated surface.

Related

• Within the group: K1.06.1 Widgets exist to make one fact available at a glance · K1.06.2 Interaction is tightly capped by the system
• Adjacent: O3.17 Screen Exposure of Sensitive Information · K1.05 Status Bar and Notification Center
• Search terms: lock screen privacy · shoulder surfing · notification preview