Scrambled PIN Entry Mode

[mmlado]

Feature Proposal: Scrambled PIN Entry Mode

The Problem

When entering your PIN in public, anyone watching can see your physical key pattern and know your PIN. ATMs solved this decades ago with scrambled keypads. Hardware wallets should too.

The Solution

Add a scrambled PIN mode users can toggle on-demand:

Normal Mode (Default)

• Current behavior - fast muscle memory entry
• Use at home, trusted environments

Scrambled Mode

• Screen shows randomized keypad layout
• User reads screen, taps corresponding physical key
• Observer sees meaningless physical pattern
• Use in public, crowded places

How It Works

Normal entry:

┌─────────────────────────┐
│                         │
│      Keycard PIN        │
│       ○ ○ ○ ○ ○ ○       │
│                         │
│              [scrambled]│
└─────────────────────────┘

Just start typing → normal mode

Tap OK before first digit:

┌─────────────────────────┐
│      Keycard PIN        │
│      ┌───┬───┬───┐      │
│      │ 7 │ 3 │ 9 │      │
│      │ 2 │ 5 │ 1 │      │
│      │ 4 │ 8 │ 6 │      │
│      │   │ 0 │   │      │
│      └───┴───┴───┘      │
│       ○ ○ ○ ○ ○ ○       │
│                 [normal]│
└─────────────────────────┘

Layout randomized, observer can't learn PIN

Mode stays active for session, resets on power cycle or when card is removed.

Real-World Examples

At home: Just type normally (fast, convenient)

Coffee shop, someone behind you:

• Tap OK before entering PIN
• Read screen, enter using scrambled layout
• They see you tap keys but learn nothing

Mid-transaction, notice someone watching:

• Quick OK tap switches to scrambled
• Threat neutralized

Security Benefits

• Defeats shoulder surfing
• Defeats video surveillance (needs both screen + keypad angle)
• Defeats thermal imaging (different keys each time)
• Defeats wear pattern analysis

Why This Design

• Simple trigger: One tap before first digit
• Session-sticky: Switch once, stays active
• Auto-reset: Returns to normal on reboot
• Context-aware: User chooses based on environment

Technical Notes

• Uses hardware RNG for Fisher-Yates shuffle
• Leverages existing keyboard rendering code
• Screen: 320x240 (plenty of space)
• Complexity: Medium

Open Questions

1. Should there be a setting for default mode, or always start with Normal?
2. Should PUK (12 digits) also support scrambled mode?

User Empowerment Philosophy

This feature embodies: "Your device, your choice, your risk assessment."

Users understand their environment better than any fixed security policy:

• At home with family? Fast entry is fine.
• In a busy airport? Quick tap for scrambled mode.
• Regular coffee shop with cameras? User decides.

Hardware wallets should empower users to make intelligent security decisions based on real-time context, not force one-size-fits-all policies.

Looking for feedback on the UX flow and interest!

[mmlado]

I could do this feature after feedback. I would need help for testing as I don't have a development board and I could only guarantee that it compiles.