Stealing PINs via mobile sensors: actual risk versus user perception

• Published in: International journal of information security Vol. 17; no. 3; pp. 291 - 313
• Main Authors: Mehrnezhad, Maryam, Toreini, Ehsan, Shahandashti, Siamak F., Hao, Feng
• Format: Journal Article
• Language: English
• Published: Berlin/Heidelberg Springer Berlin Heidelberg 01.06.2018; Springer Nature B.V
• Subjects: Artificial neural networks; Cell phones; Cellular telephones; Coding and Information Theory; Communications Engineering; Computer Communication Networks; Computer Science; Cryptology; Cybersecurity; Electronic devices; JavaScript; Management of Computing and Information Systems; Networks; Operating Systems; Perceptions; Regular Contribution; Risk perception; Sensors; Smartphones; Streams; Websites; User privacy; Mobile sensors; JavaScript attack; Machine learning; User study; User security; Risk perception; PINs; Mobile browsers

In this paper, we present the actual risks of stealing user PINs by using mobile sensors versus the perceived risks by users. First, we propose PINlogger.js which is a JavaScript-based side channel attack revealing user PINs on an Android mobile phone. In this attack, once the user visits a website...