Guessing smart phone PINs by monitoring the accelerometer
1–10 of 72 posts
Re: Guessing smart phone PINs by monitoring the accelerometer
#2I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.
Re: Guessing smart phone PINs by monitoring the accelerometer
#3This stuff is so fascinating... and so frustrating. Now browsers have accelerometer data behind a permission prompt. It makes total sense given stuff like this but it used to be a nice little way to create immediately playable games, apply visual parallax-y effects... and now we have permission prompts sat in front of that.
I guess I’m not blaming anyone here, just amazed that there isn’t any data source that doesn’t leak something sensitive!
Re: Guessing smart phone PINs by monitoring the accelerometer
#4"Figure out" means, in this case, classify. So it can tell which of 50 is 'the one'if its in that set. That's a hell of a long way away from decoding your PIN from the tens of thousands possible.
Re: Guessing smart phone PINs by monitoring the accelerometer
#5I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction.
The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article.
It is a bit of a usability trade-off though as you can't enter a pin using muscle memory alone anymore, as you must first understand the current keypad layout.
Re: Guessing smart phone PINs by monitoring the accelerometer
#6I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.
I was going to say Apple must have became aware of such flaw a year ago (iOS 12.2). However checking back on the article I see it is from 2013! So for all this time nothing has been done, Apple reacted last year, and Google has done nothing.
Worrying.
Re: Guessing smart phone PINs by monitoring the accelerometer
#7Someone add (2013) to this
Re: Guessing smart phone PINs by monitoring the accelerometer
#8I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
I had this feature enabled on my old phone, on which I had flashed LineageOS. Unfortunately the new phone's stock ROM doesn't have that, but it also features a fingerprint sensor, so I don't really type my passcode that frequently anymore.
Re: Guessing smart phone PINs by monitoring the accelerometer
#9Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?
Re: Guessing smart phone PINs by monitoring the accelerometer
#10I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction. The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article. It is a bit of a usability trade-off…
When I was in Barcelona an ATM had its keypad numbers flipped (7 8 9; 4 5 6; 1 2 3), which I only realized after the first attempt. Second attempt I got my PIN wrong, and I did not dare to try it a third (and final) attempt. Apparently it's really muscle memory.