Everything I say about non-obscuring, and notes that you probably don't need it at all; devices are personal and those with secure info better lock the device -- device lock hints: make gestures clear, pattern codes, etc. ALSO, some notes about best practices for pattern and numeric unlock; it is easy to crack a lock by fingerprinty screens, so if truly high security, make it random position -- variation maybe cut by not design but security requirements, and designs that fall from that... Low: None, Mid: Pin/Pattern, High:??? + randomizing and non-form systems so the handset has no way of thwarting you and saving the entry
Problem
Solution
Do not require explicit authentication by default. Mobiles are personal, so only require authentication for first time entry, very high security situations, and for multi-user devices such as kiosks.
Personal mobile devices also all have built in security methods, so users can lock them if security conscious. During setup, you may remind users of these features instead of adding additional security to your application.
User identity, whenever known, should be used and as much information in the system displayed as possible before authentication gateways are passed. Authentication may then only require the password.
Authentication must be presented in context, so it is clear what system the user is gaining access to, and why the level of security is needed. Entry methods must be designed to encourage ease of access, and prevent miskeying.
Variations
Text/numeric entry, using conventional input methods, whether hardware or virtual
Virtual, changing pad
Pattern
Additional entry methods, such as voice, are not yet established enough to have best practices in the mobile space, and therefore no design patterns exist.
Remember that entry of credentials is not enough to count as a full security methodology. Recovery, reset and out-of-channel notifications are also required, but are systematic approaches outside the scope of this document. For very high security applications, multi-factor authentication, biometrics and token-based security systems (such as RSA SecureID) must also be considered.
Interaction Details
Pop-up or full screen
Text Entry not obscured usually...
Pad entry (on screen keypad, standard or custom - preference is to randomized if you go this way)
Pattern entry (on screen gestural shapes)
Provide links to seek help on entry, get more information on security of the system, and to recovery and/or reset methods.
Presentation Details
Title and describe... not just app, but section or process. If title does not imply why they need to authenticate, add a description
Label fields
If identified, provide additional user information, such as their avatar photo and name. Do not just ask for the password with no supporting information
Antipatterns
Use caution when obscuring fields. Do not assume that the default password method built into the OS is secure. Most still reveal the character being typed, as required in triple-tap text entry modes. If an obscured entry is required due to use as a kiosk, while attached to a projected device or in other shared situations, be sure to specify how obscured it must be.