News for hackers. Stuff that matters.

A comment on The way people tilt their smartphone 'can give away passwords and pins'.

Re:The way people tilt their smartphone 'can give away passw... by tboyd47 on Tuesday April 11, 2017 @09:49AM (#14087692)
> We demonstrate how an inactive or even a minimised web page, using JavaScript, is able to listen to and silently report the device motion and orientation data about a user who is working on a separate tab or a separate app on the device.

This is brilliant and well-explained.

On page 6 of the PDF, the authors include a breakdown of the leakages they found in each browser family. The two that were most significant to me is Chrome's "Active/Other" leak on iPhones and Safari's "Locked" leak. I believe this means that malicious Javascript (1) on Google Chrome on an iPhone on an inactive tab, and (2) on mobile Safari while the screen is locked, can access tilt and motion data at a level of detail sufficient to deduce what the user is typing.

[ Parent | on HN ]
Re:The way people tilt their smartphone 'can give away passw... by jacquesm on Tuesday April 11, 2017 @10:08AM (#14087869)
Accelerometer data could be used too to figure out how long it took to move from one entry on a virtual keyboard to another reducing the search space considerably.
[ Parent | on HN ]
Re:The way people tilt their smartphone 'can give away passw... by Neliquat on Wednesday April 12, 2017 @09:20AM (#14097343)
Another good reason to use a non standard keyboard.
[ Parent | on HN ]
Re:The way people tilt their smartphone 'can give away passw... by plopz on Tuesday April 11, 2017 @04:02PM (#14091895)
Isn't Google Chrome on iPhones just a reskinned Safari since Apple doesn't allow other browsers to use their own engines?
[ Parent | on HN ]
Re:The way people tilt their smartphone 'can give away passw... by militantVagrant on Wednesday April 12, 2017 @01:19AM (#14094985)
Bingo. It's not really Chrome at all. A better author would have pointed out that the iOS platform is flawed, its singular browser in any of its different wrappers is vulnerable in exactly the same way.
[ Parent | on HN ]