  While mobile devices frequently require users to authenticate to prevent
unauthorized access, mobile devices typically do not authenticate to their
users. This leaves room for users to unwittingly interact with different mobile
devices. We present GoodVibes authentication, a variant of mobile
device-to-user authentication, where the user's phone authenticates to the user
through their wristwatch vibrating in their pre-selected authentication
vibration pattern. We implement GoodVibes authentication as an Android
prototype, evaluate different authentication scenarios with 30 participants,
and find users to be able to well recognize and distinguish their
authentication vibration pattern from different patters, from unrelated
vibrations, and from the pattern being absent.
