Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Guessing smart phone PINs by monitoring the accelerometer

schneier.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Guessing smart phone PINs by monitoring the accelerometer

#31

Post by marton78 »

buckminster wrote: post #21
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

You could shrink the keypad and randomly place it on the screen. Or independently change the width and height of the columns and rows of buttons. Or combine the two. This would make it harder to guess the PIN from the accelerometer and you could still use your muscle memory. Designers would have a fit though. Edit: though on reflection, this might make no difference. Knowing the relative locations of the key presses…

You could move and zoom the keyboard after every key press

Re: Guessing smart phone PINs by monitoring the accelerometer

#32

Post by WrtCdEvrydy »

wpietri wrote: post #12
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen).

Edit: Added more context.

Re: Guessing smart phone PINs by monitoring the accelerometer

#33

Post by Wistar »

buckminster wrote: post #21
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

You could shrink the keypad and randomly place it on the screen. Or independently change the width and height of the columns and rows of buttons. Or combine the two. This would make it harder to guess the PIN from the accelerometer and you could still use your muscle memory. Designers would have a fit though. Edit: though on reflection, this might make no difference. Knowing the relative locations of the key presses…

Perhaps randomly changing the layout? Sometimes the keys are presented in a circular format, another in a figure-8, zigzag, odd numbers at the top of the screen, even at the bottom, etc.

Another tactic might be to have randomized extra keys that show up in a different color or position that aren't a part of the actual PIN but that must all be pressed, in any order, to intermix in the sequence as the the real PIN is entered in proper order. The extra numbers obfuscate the real PIN.

Say, the real PIN is 18145 but 4 extra keys in a distinct color or motif are presented so that the key presses might be 1-8 (real) 8-4 (false) 1-4 (real) 3-6 (false) 5 (real) but the false keys are different each time. It wouldn't matter what order the false keys are pressed or when in the sequence they are pressed as they are ignored by the real PIN mechanism.

Re: Guessing smart phone PINs by monitoring the accelerometer

#34

Post by notatoad »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

randomizing the position is also great to prevent people from reading the fingerprints on the screen. after the oleophobic coating has worn off, it's really easy to hand somebody a freshly-cleaned screen and see where their four finger presses were when they hand it back.

Re: Guessing smart phone PINs by monitoring the accelerometer

#35

Post by voidmain0001 »

dorfsmay wrote: post #29
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

This is the one feature I miss from CyanogenMod!

Yeah a number of Android versions provided this a few years ago. I guess it was removed because metrics showed it wasn't used? https://android.stackexchange.com/questions/27746/where-to-f...

Re: Guessing smart phone PINs by monitoring the accelerometer

#36

Post by catalogia »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Sounds like an accessibility disaster for people with marginal vision.

Couldn't this also be solved using a piece of plastic that shields view of the keypad to people not standing directly over it?

Re: Guessing smart phone PINs by monitoring the accelerometer

#37

Post by andrepd »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Reminds me of Runescape bank PINs... :)

Re: Guessing smart phone PINs by monitoring the accelerometer

#38

Post by gruez »

reisub0 wrote: post #30
JoeAltmaier wrote: post #4

"Figure out" means, in this case, classify. So it can tell which of 50 is 'the one'if its in that set. That's a hell of a long way away from decoding your PIN from the tens of thousands possible.

This was a paper from 2013 though, 7 years ago. I'm sure they've more than made it a proper technology now, with all the compute power and deep learning and what not. Maybe unrelated, but WhatsApp does monitor your phone accelerometer data 100% of the time, even when it's in the background. An app doesn't even need to ask for permission to get access to the accelerometer data, so there's not even a pop up of any sort…

>but WhatsApp does monitor your phone accelerometer data 100% of the time

Source for this? Did anyone call them out on it? What plausible reason is there to have it on 24/7?

Re: Guessing smart phone PINs by monitoring the accelerometer

#39

Post by uniformlyrandom »

Razengan wrote: post #24
angry_octet wrote: post #9

Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?

I wish iOS didn't show each character as you type your password. HOW is that even helpful, let alone not having an option to disable that?

It is kind of helpful, but I agree that it should be an opt-in in accessibility settings.

Re: Guessing smart phone PINs by monitoring the accelerometer

#40

Post by akira2501 »

andrepd wrote: post #37
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Reminds me of Runescape bank PINs... :)

Reminds me of the Hirsch Scramblepad.

https://www.identiv.com/products/physical-access/readers/hir...

Post reply on HN