Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Guessing smart phone PINs by monitoring the accelerometer

schneier.com

Post reply on HN
Print view View original

61–70 of 72 posts

Re: Guessing smart phone PINs by monitoring the accelerometer

#61

Post by perl4ever »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

I have found that when I try to enter a password on my phone that I have previously only used on a computer, I sometimes have retained nothing but muscle memory which doesn't translate from keyboard to touchscreen.

Re: Guessing smart phone PINs by monitoring the accelerometer

#62

Post by mguerville »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

My French bank uses this as well (on desktop), and the numbers can’t be typed they have to be clicked on. I think it’s not common enough but a good security feature against attack vectors we don’t reall think about

Re: Guessing smart phone PINs by monitoring the accelerometer

#63

Post by kibibyte »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

A few years ago, ANZ Bank offered such a device that they called FastPay. It connected to their mobile phone POS app and helped randomized the PIN entry on the app. Here's their marketing demonstration on it https://youtu.be/I27-B36SaAg?t=80

I'm not sure if it was so much to defend against this type of attack as it was to ensure that no software could intercept taps on the screen and derive your PIN. I believe that the part of PCI rules that cover PIN entry led to this implementation, since this is a mobile POS app running on a potentially hostile device. Typically, POS vendors build dedicated hardware for PIN entry because it's much easier to lock down a system that they have full control over, and thus comply with PCI rules.

(For what it's worth, PCI now has rules on software-based PIN entry on mobile phones.)

Re: Guessing smart phone PINs by monitoring the accelerometer

#64

Post by walrus01 »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

https://www.swhouse.com/products/readers_Schlage_Scramble_Ke...

This is a not very uncommon type of keypad used for high security facilities, where you may need to scan a proximity card and then enter a PIN.

Re: Guessing smart phone PINs by monitoring the accelerometer

#65

Post by fiddlerwoaroof »

Razengan wrote: post #24
angry_octet wrote: post #9

Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?

I wish iOS didn't show each character as you type your password. HOW is that even helpful, let alone not having an option to disable that?

I use it all the time to correct password mistakes: I would be really irritated if that went away: in fact, I frequently use devtools on my laptop to change password inputs to text inputs

Re: Guessing smart phone PINs by monitoring the accelerometer

#66

Post by atoav »

untog wrote: post #3

This stuff is so fascinating... and so frustrating. Now browsers have accelerometer data behind a permission prompt. It makes total sense given stuff like this but it used to be a nice little way to create immediately playable games, apply visual parallax-y effects... and now we have permission prompts sat in front of that. I guess I’m not blaming anyone here, just amazed that there isn’t any data source that doesn’t…

I don't see the issue there: it is good if my browser tells me what is going on and leaves the decision to me.

Of course in an ideal world we would be able to trust the sites we visit enough to not jave our browsera protect us, but that is not how a ad financed web worka sadly

Re: Guessing smart phone PINs by monitoring the accelerometer

#67

Post by tinus_hn »

mdorazio wrote: post #2

I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

The accelerometer calibration can be detected by websites and is a way to identify users. On the other side the use case for websites is pretty limited.

https://sensorid.cl.cam.ac.uk/

Re: Guessing smart phone PINs by monitoring the accelerometer

#68

Post by h4waii »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Both LineageOS and GrapheneOS have this feature, it was extremely useful in the past, until FBE (File Based Encryption) took over from FDE (Full Disk Encryption).

You can't separate the lockscreen password and the startup password anymore, so we lost the usability of unlocking using a shorter scrambled PIN but still retaining a longer passphrase for FDE when the device was powered off.

None of this was ever a supported thing, it had to be manually done using `vdc` frontend to `vold` but it was a nice feature.

Re: Guessing smart phone PINs by monitoring the accelerometer

#69

Post by dorfsmay »

voidmain0001 wrote: post #35
dorfsmay wrote: post #29

Earlier quoted context omitted.

This is the one feature I miss from CyanogenMod!

Yeah a number of Android versions provided this a few years ago. I guess it was removed because metrics showed it wasn't used? https://android.stackexchange.com/questions/27746/where-to-f...

I had not realised it was in Android proper, I have only seen it in Cyanogenmod. I wonder if it wasn't used more because people didn't know about it, and didn't realise how much safer it was. Sad that they removed it.

Re: Guessing smart phone PINs by monitoring the accelerometer

#70

Post by acranox »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

There's a potential secondary usability trade-off. I only know my PIN by the pattern it makes on the keys. I don't actually have the numbers memorized, just the positional order on a standard keypad layout. So if the numbers are randomized, I would have a really hard time.
Post reply on HN