How do you get the accelerometer data?
Surely if you have enough privilege to get that, you could just get input data directly?
Guessing smart phone PINs by monitoring the accelerometer
11–20 of 72 posts
Re: Guessing smart phone PINs by monitoring the accelerometer
#12I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.
Re: Guessing smart phone PINs by monitoring the accelerometer
#13How do you get the accelerometer data? Surely if you have enough privilege to get that, you could just get input data directly?
By requesting access to it. To a user that just installed a e.g. step counting app that wouldn't be suspicious.
Otherwise on Android apps would need to request accessibility feature access to be able to monitor keyboard input into other apps (and there is an explicit warning), or, which is most common, request an overlay permission and start a "phishing overlay" if a targeted app is started by the user.
Re: Guessing smart phone PINs by monitoring the accelerometer
#14Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?
I imagine it could be a useful signal - most "touch" on a particular key at the instant the accelerometer gives largest jerk ... might help to avoid false keying?
Re: Guessing smart phone PINs by monitoring the accelerometer
#15I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.
Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies,
5(2), 2010.
https://uxpajournal.org/usability-evaluation-of-randomized-k...
Re: Guessing smart phone PINs by monitoring the accelerometer
#16I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
At least one bank in France (Credit Agricole) also randomizes the placement of numbers on virtual PIN pads on their e-banking website and mobile app.
Re: Guessing smart phone PINs by monitoring the accelerometer
#17Earlier quoted context omitted.
Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.
Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies, 5(2), 2010. https://uxpajournal.org/usability-evaluation-of-randomized-k...
Thanks! That's indeed interesting.
What I was hoping somebody would study is the ability of practiced thieves to get the PIN under both circumstances. But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.
One quibble I have with the study is that they used novel PINs. I know I'm much faster when typing my real PIN than an arbitrary one. So I suspect the time penalty for random digit layout is larger than they show here.
Re: Guessing smart phone PINs by monitoring the accelerometer
#18I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
At least one bank in France (Credit Agricole) also randomizes the placement of numbers on virtual PIN pads on their e-banking website and mobile app.
I’ve also seen it with another bank (BNP Paribas), which is pretty good on phones but annoying on website, since it breaks my password manager. They load images with numbers but I can’t spot any obvious pattern in the requests (which is probably a good design).
Re: Guessing smart phone PINs by monitoring the accelerometer
#19Earlier quoted context omitted.
At least one bank in France (Credit Agricole) also randomizes the placement of numbers on virtual PIN pads on their e-banking website and mobile app.
I’ve also seen it with another bank (BNP Paribas), which is pretty good on phones but annoying on website, since it breaks my password manager. They load images with numbers but I can’t spot any obvious pattern in the requests (which is probably a good design).
Yep, BNP have been doing this for well over a decade for their online banking. They also do it on their mobile banking app.
Re: Guessing smart phone PINs by monitoring the accelerometer
#20I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.
This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.