Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Guessing smart phone PINs by monitoring the accelerometer

schneier.com

Post reply on HN
Print view View original

41–50 of 72 posts

Re: Guessing smart phone PINs by monitoring the accelerometer

#41

Post by adrianmonk »

angry_octet wrote: post #26
adrianmonk wrote: post #23

Earlier quoted context omitted.

It's probably not that simple and clear cut. There are probably some reasonable use cases for apps that need the accelerometer on continuously. Which makes it a trade-off. One example could be a pedometer / activity tracker app that totals up your number of steps per day. Suppose the user decides to get on a treadmill and walk for 30 minutes but finds it boring so they text their friends while doing it. Maybe they ha…

Doesn't Android know when the user is authenticating? How many seconds a day are you inputting to the lock screen? Doesn't need to be for any time the keyboard is open. (Of course, doing it semi randomly is also now necessary, to obscure user unlock times.) As to weak info, you do it again and again, I'd say it's pretty good info.

If you're only trying to solve the very narrow problem of entering a PIN to authenticate to the system, then sure. When you said "during keyboard input", I thought you were being more general, but I suppose you must have meant during keyboard input of the system PIN.

I don't think that PIN is the only sensitive information that matters, though. Android supports a numeric keypad input mode for apps. If I'm entering my credit card number into some app (Lyft, Amazon Shopping, etc.), that seems pretty sensitive. Maybe more sensitive than the system PIN even, because if I know your system PIN, I can't necessarily do anything with it unless I have physical access to your device or you've re-used the same PIN elsewhere.

Re: Guessing smart phone PINs by monitoring the accelerometer

#42

Post by Tyr42 »

wpietri wrote: post #12
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

I remember when Runescape added that to opening your bank account. Perhaps it was to deter bots, but also to stop any key/mouse loggers from giving away your secrets.

Re: Guessing smart phone PINs by monitoring the accelerometer

#43

Post by samatman »

wpietri wrote: post #17
tantalor wrote: post #15

Earlier quoted context omitted.

Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies, 5(2), 2010. https://uxpajournal.org/usability-evaluation-of-randomized-k...

Thanks! That's indeed interesting. What I was hoping somebody would study is the ability of practiced thieves to get the PIN under both circumstances. But this does indeed show that it's slower, which would certainly make shoulder-surfing easier. One quibble I have with the study is that they used novel PINs. I know I'm much faster when typing my real PIN than an arbitrary one. So I suspect the time penalty for rando…

> But this does indeed show that it's slower, which would certainly make shoulder-surfing easier.

I wouldn't say certainly.

There's more time to observe each keystroke but you have to know what the keystroke is. I've deduced people's 4 digit pin, by accident, from an angle where I can barely see their screen. Randomizing the keypad prevents this.

Re: Guessing smart phone PINs by monitoring the accelerometer

#44

Post by bryanrasmussen »

wpietri wrote: post #17
tantalor wrote: post #15

Earlier quoted context omitted.

Y. S. Ryu, D. H. Koh, B. L. Aday, X. A. Gutierrez, and J. D. Platt. Usability evaluation of randomized keypad. Journal of Usability Studies, 5(2), 2010. https://uxpajournal.org/usability-evaluation-of-randomized-k...

Thanks! That's indeed interesting. What I was hoping somebody would study is the ability of practiced thieves to get the PIN under both circumstances. But this does indeed show that it's slower, which would certainly make shoulder-surfing easier. One quibble I have with the study is that they used novel PINs. I know I'm much faster when typing my real PIN than an arbitrary one. So I suspect the time penalty for rando…

I think it would only make shoulder-surfing easier if the shoulder-surfer was willing to make what they were doing more apparent.

Also if this was widespread, which I suppose it never will be, people would become used to the randomized keyboard and probably be able to do it a lot quicker.

Re: Guessing smart phone PINs by monitoring the accelerometer

#45

Post by Wistar »

Wistar wrote: post #33
buckminster wrote: post #21

Earlier quoted context omitted.

You could shrink the keypad and randomly place it on the screen. Or independently change the width and height of the columns and rows of buttons. Or combine the two. This would make it harder to guess the PIN from the accelerometer and you could still use your muscle memory. Designers would have a fit though. Edit: though on reflection, this might make no difference. Knowing the relative locations of the key presses…

Perhaps randomly changing the layout? Sometimes the keys are presented in a circular format, another in a figure-8, zigzag, odd numbers at the top of the screen, even at the bottom, etc. Another tactic might be to have randomized extra keys that show up in a different color or position that aren't a part of the actual PIN but that must all be pressed, in any order, to intermix in the sequence as the the real PIN is e…

... or, some numbers in the PIN require being pressed some random number of times until the key graphically indicates it is accepted. 1-8-1-4-5 might need to be entered as 1-1-8-1-4-4-4-5-5 with the repeat number differing each time.

Or the PIN pad can be presented with a random requirement to slide between 2 or 3 sequential digits rather than lift and tap. Tap-1-Slide-8-1-4-Tap-5.

Re: Guessing smart phone PINs by monitoring the accelerometer

#46

Post by ozim »

notatoad wrote: post #34
axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

randomizing the position is also great to prevent people from reading the fingerprints on the screen. after the oleophobic coating has worn off, it's really easy to hand somebody a freshly-cleaned screen and see where their four finger presses were when they hand it back.

For me it is great way to never remember any pin, I heavily rely on muscle memory for pins.

Re: Guessing smart phone PINs by monitoring the accelerometer

#47

Post by Dahoon »

fmjrey wrote: post #6
mdorazio wrote: post #2

I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

I was going to say Apple must have became aware of such flaw a year ago (iOS 12.2). However checking back on the article I see it is from 2013! So for all this time nothing has been done, Apple reacted last year, and Google has done nothing. Worrying.

It still works in iOS.

Re: Guessing smart phone PINs by monitoring the accelerometer

#48

Post by ficklepickle »

gruez wrote: post #38
reisub0 wrote: post #30

Earlier quoted context omitted.

This was a paper from 2013 though, 7 years ago. I'm sure they've more than made it a proper technology now, with all the compute power and deep learning and what not. Maybe unrelated, but WhatsApp does monitor your phone accelerometer data 100% of the time, even when it's in the background. An app doesn't even need to ask for permission to get access to the accelerometer data, so there's not even a pop up of any sort…

>but WhatsApp does monitor your phone accelerometer data 100% of the time Source for this? Did anyone call them out on it? What plausible reason is there to have it on 24/7?

I was also curious. I found a relevant reddit discussion:

https://www.reddit.com/r/lgg6/comments/7yxk0a/whatsapp_insan...

Re: Guessing smart phone PINs by monitoring the accelerometer

#50

Post by judge2020 »

braindongle wrote: post #28
mdorazio wrote: post #2

I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

By locked down, do you mean requiring justification to get through the app store or accessing the data at all? The latter is no problem for iOS-only [0] or Flutter [1]. I've been spending much time with cross-platform sensor access in Flutter. It works. [0] https://developer.apple.com/documentation/coremotion/getting... [1] https://pub.dev/packages/sensors

> in Safari
Post reply on HN