Locked Screen, Unlocked Secrets

By Milan Kuželka, University of Belgrade

You close your laptop, press the lock shortcut (Win + L on Windows or Ctrl + Cmd + Q on Mac), and step away for a quick coffee break or a brief meeting down the hall. You feel secure knowing your computer is protected by a strong password. But while you are away from your desk, your device might still be talking to anyone walking by.

One of the most common seemingly minor, overlooked habits is ignoring the notifications that pop up on a locked screen. Many view lock screen previews as a helpful convenience that lets us glance at incoming messages without re-entering a password. However, that small convenience introduces a real privacy and security risk.

How harmless pop-ups become security risks

To understand the problem, look at what appears on your screen when you aren’t around. Notifications are rarely just simple alerts; they frequently display message previews, document titles, calendar entries, and sensitive single-use verification codes.

Consider these real-world scenarios:

• Leaking confidential business data: Email notifications often show the sender’s name and the first few lines of the message. A notification reading “Attached is the draft contract for Client X” or “Here are the updated server credentials” exposes sensitive internal context to visitors, maintenance staff, or unauthorized personnel.
• Exposing personal messages: Chat applications like WhatsApp, Signal, or Slack often show incoming personal messages. Beyond enterprise security, unexpected visual access to your personal communications compromises your workplace privacy.
• Exposing two-factor authentication (2FA/OTP) Codes: Most secure platforms rely on two-factor authentication. When signing in, the system sends a 6-digit code via SMS or an authenticator app. If that code displays on your locked phone screen while you step away, anyone walking past your desk can read it and potentially hijack your session.
• Enabling social engineering: Cybercriminals do not always need complex code to breach a system; gathering small contextual details often suffices. Seeing a lock screen calendar alert for an upcoming 2pm meeting with a specific vendor gives an attacker precise details to craft a convincing phishing email impersonating that vendor.

Key technical terms explained

Understanding how to protect your devices becomes straightforward once a few core terms are clear:

• Lock screen: The display state where system access and files remain blocked until you authenticate via password, PIN, fingerprint, or facial recognition. Its main purpose is preventing unauthorized physical access.
• Notification preview: A feature displaying a snippet of content (text, sender, media) before the device is unlocked. This is the specific setting that requires adjustment to safeguard data.
• Shoulder surfing: A social engineering tactic where an unauthorized person visually observes your screen or keyboard to capture sensitive data (passwords, PINs, or notification details) without direct technical intervention.

Practical steps: taking control of your screen lock

Resolving this vulnerability requires no advanced technical expertise and minimal effort. The goal is not to eliminate helpful alerts entirely, but to ensure devices notify you of an incoming message while hiding its content until identity is verified.

1. Mobile devices (iOS & Android)

• iPhone (iOS):
  • Go to Settings > Notifications.
  • Tap Show Previews.
  • Change the setting to When Unlocked (or Never for maximum privacy).
  • Result: When a message arrives while locked, the screen displays the app name (e.g., “WhatsApp – 1 Notification”), but hides the content until Face ID or Touch ID verifies your identity.
• Android devices:
  • Go to Settings > Notifications (or Lock Screen, depending on manufacturer).
  • Locate Notifications on Lock Screen.
  • Select Hide sensitive content or Don’t show notifications at all.

2. Laptops and desktops

• Windows 10 / 11:
  • Go to Settings > System > Notifications.
  • Uncheck Show notifications on the lock screen.
  • Ensure Hide content when notifications are shown on the lock screen is enabled.
• macOS:
  • Go to System Settings > Notifications.
  • Scroll to Show previews.
  • Set it to When Unlocked or Never.

A Small Habit with a Big Impact

Cybersecurity is rarely about a single expensive piece of software; it is built on a series of small, intentional everyday choices. Configuring your devices to hide notification previews on locked screens is an effortless step that yields significant protection.

By making this adjustment, you achieve three key outcomes:

1. Shield your personal and organizational data from Shoulder surfing.
2. Prevent unauthorised eyes from viewing single-use verification codes.
3. Retain full control over your privacy when you are away from your desk.

The next time you lock your screen to step away, ask yourself: What is my screen revealing right now? Taking two minutes today to update your notification settings is a small habit that delivers a big impact.

About the author

Milan Kuželka is a Senior Project Administrator at the University of Belgrade. He has also been an active participant in GÉANT projects for over 10 years. Combining his background in economics and psychotherapy, he is involved in a wide range of activities, from financial control to the organization of international training events. He is a strong advocate for lifelong learning and the promotion of international activities within the academic community.