Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Guessing smart phone PINs by monitoring the accelerometer

schneier.com

Post reply on HN
Print view View original

51–60 of 72 posts

Re: Guessing smart phone PINs by monitoring the accelerometer

#51

Post by iudqnolq »

WrtCdEvrydy wrote: post #32
wpietri wrote: post #12

Earlier quoted context omitted.

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen). Edit: Added more context.

When would you have a keylogger and not a screen logger?

Re: Guessing smart phone PINs by monitoring the accelerometer

#52

Post by Gudin »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

It's also a hell of annoying. Since in 99% of the cases noone is looking over your shoulder it's OK to not give me a puzzle every time.

Also, with consistent numpad I'm able to enter all digits super-quick which is very hard to track. While with randomized numpad I need 5 seconds to find my numbers.

Re: Guessing smart phone PINs by monitoring the accelerometer

#53

Post by WrtCdEvrydy »

iudqnolq wrote: post #51
WrtCdEvrydy wrote: post #32

Earlier quoted context omitted.

Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen). Edit: Added more context.

When would you have a keylogger and not a screen logger?

Trezor has a separate screen... that screen has your numbers, your computer screen has a blank grid of 3x3. You look at the Trezor and press the correct number in the blank grid.

Re: Guessing smart phone PINs by monitoring the accelerometer

#54

Post by r1ch »

mdorazio wrote: post #2

I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

Meanwhile in Android land, Chrome gives all websites access to sensor data without any permission prompts!

Re: Guessing smart phone PINs by monitoring the accelerometer

#55

Post by yjftsjthsd-h »

iudqnolq wrote: post #51
WrtCdEvrydy wrote: post #32

Earlier quoted context omitted.

Trezor did it for Crypto (so you could use the wallet in a keylogged environment). The screen (on the device) changes the numbers and you type using the location on an on-screen numpad (on your computer screen). Edit: Added more context.

When would you have a keylogger and not a screen logger?

Hardware-based keyloggers come to mind (especially the kind that MITMs the keyboard cord).

Re: Guessing smart phone PINs by monitoring the accelerometer

#56

Post by YetAnotherNick »

r1ch wrote: post #54
mdorazio wrote: post #2

I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

Meanwhile in Android land, Chrome gives all websites access to sensor data without any permission prompts!

AFAIR, it is the same for Safari on iOS.

Re: Guessing smart phone PINs by monitoring the accelerometer

#57

Post by heavenlyblue »

joshvm wrote: post #20
wpietri wrote: post #12

Earlier quoted context omitted.

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.

I believe scrambling should work the best if you scramble the keypad for every digit entered, rather than for the whole of them at once. Otherwise at least the same key presses should be immediately recognisable?

Re: Guessing smart phone PINs by monitoring the accelerometer

#58

Post by lonelappde »

ozim wrote: post #46
notatoad wrote: post #34

Earlier quoted context omitted.

randomizing the position is also great to prevent people from reading the fingerprints on the screen. after the oleophobic coating has worn off, it's really easy to hand somebody a freshly-cleaned screen and see where their four finger presses were when they hand it back.

For me it is great way to never remember any pin, I heavily rely on muscle memory for pins.

What devices do you have with a dedicated pin pad? Your safe?

Re: Guessing smart phone PINs by monitoring the accelerometer

#59

Post by rdtsc »

joshvm wrote: post #20
wpietri wrote: post #12

Earlier quoted context omitted.

Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.

I heard about a device that had fewer keys say 5 only, one for each finger, but to use it you had to insert your hand into a slot in the machine so it’s completely invisible from the outside what keys you’re pressing. Presumably in theory they could use one slot for each hand to get to the full 10 digit range.

Re: Guessing smart phone PINs by monitoring the accelerometer

#60

Post by vxNsr »

axelfontaine wrote: post #5

I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…

Anyone who played runescape 15 years ago can tell you about how annoying this is.
Post reply on HN