Private personal-device input moves sensitive actions out of public view

What it is

Typing an ID number on a station board, picking a stigmatized clinic, confirming a named ticket—passers-by and the operator share the same glass. Personal-device input offloads sensitive public actions means moving those steps onto the person's phone or wearable, while the public screen keeps only state that points at no one: the service still runs, the seat is still free, the next departure is at such-and-such. The cost being cut is the action being watched, not how tasks continue across devices, and not how a session is wiped at the end. What is sensitive is the doing—keying, ticking, signing—not only whether a result later remains on screen.

Why it happens

A public screen's viewing cone is an order of magnitude larger than a phone's; shoulder surfing barely needs to close in. Keying and choosing also pin attention on the operator: poking at a large board tells bystanders that something careful is happening. A phone shrinks the cone to the chest; bystanders see “another person looking at a phone,” an already-legal public pose. If the public screen still mirrors every field from the phone, the channel has not changed—it has only grown a larger subtitle. What actually dumps the performance cost is a split: the board carries public state for everyone, the personal device carries input only the owner should see. If pairing itself requires scanning a named code in public, or reading verification digits aloud, the sensitive material is walked back onto the board. People without a phone must still be able to finish on the board, or the split leaves those who cannot or will not use a companion exposed even longer.

Studying it

Build the same sensitive step as “all on the board” versus “input on the phone, board shows only non-personal state,” and compare completion, skip-to-staff, and shoulder-surf attempts on a site with bystanders. Operators can also be asked how many people could have seen what they entered.

Independent variables: which screen shows the sensitive fields, whether the board mirrors the phone, whether pairing exposes identity. Dependent variables: completion and time on that step, share who divert to a staffed window, fields a bystander can recall, rated being watched.

A lab one-way mirror for shoulder surfing does not match station distance or motive. Do not read “willing to use the phone” as successful relief—some people use the phone only because the board keyboard is bad. When pairing fails and input is forced back onto the board, performance cost can exceed starting on the board, because a public detour has already been performed.

Where it stops holding

Pure public lookup (next train, which exit) has no personal field to hide; there is nothing to split. If the user has no phone, a dead battery, or refuses to scan, the board must finish the task alone; a sensitive step must not become “app only.” When regulation requires an on-screen signature or face check in public, the phone can only prepare; the terminal state still shows. A child using a parent's phone has a family privacy boundary, not a passer-by one. Screencast or mirroring that pushes the whole phone desktop onto the board dumps notifications and unrelated threads with it, worse than no split.

Applying it

• Put ID numbers, passwords, clinical choices, and named confirmations on the phone; keep the board to service, queue, and remaining seats—state that names no one.
• Pair with a short-lived, unnamed code or a tap; do not print a username or a full verification code on the public glass.
• Keep a complete touch or touchless path on the board for people without a phone; do not switch a sensitive step into “please use the app.”
• Verify by standing uninvolved people at the usual passing distance and asking whether they can read the sensitive fields in progress; after moving input to the phone, the same distance should not yield content, and completion must not fall below the original board path.

Related

• Within the group: K7.08.1 Smaller first-move amplitude lowers spectator pressure · K7.08.2 Simultaneous entry points spread the pressure of being watched alone · K7.08.3 Publicly displayed failure increases reluctance to try again
• Adjacent: K7.04 Simultaneous Multi-user Use · K8.03 Division of Capability across Devices · O3.17 Sensitive information on screen
• Search terms: companion-device input · shoulder surfing · public-private display split