Hacker News Reader

Comment by KermitTheFrog | Hacker News Reader

Using the accelerometer/gyro data, you can also guess the password from the device with quite good accuracy(it depend) if you type in your hand and not on a flat surface.

View on HN

No you can't - apps can't read Core Motion data when your screen is locked, or they're in the background.

I don't have an iPhone, but does it have overlays for things like password managers?

Android definitely does, and I assume the same research around guessing text input would apply.

It does, but I unlock it with FaceID rather than a password. Cameras recording me typing my bitwarden master password are a bigger security concern for my password security already.

Wish there was an option to disable the magnified, per-key, onscreen keyboard bubbles when entering a password. Provide an option to show the password on entry or not, same as desktop input fields for passwords. But don't magnify each character and invert the screen to make it easier for camera imaging.

There is, at least on iPhones. But it is for all keyboard input, not just passwords. Go to Settings -> General -> Keyboard, toggle Character Preview to off.

Thanks, that's helpful, although the iOS lock screen appears to be excluded.

You may create App such as a (kind of)"navigation" app. But I'm not sure about collection data while screen is locked and password is required. Need to play with it.

I would guess the vast majority of people who need to set a PIN for the CVS app or their banking app or whatever use the same PIN to unlock their phone.

If they’re creating a PIN in the app, the developer could just store that in plain text more easily than trying to derive it from the accelerometer. I think you’re right that most people probably use the same PIN for their phone and apps, but then the app maker has easy access to the PIN because the user gave it to them

Is there an application on iOS that can listen for the accelerometer/gyro data on the background?

Health definitely does (and likely needs to for much of its functionality), but it’s first party so you’ve pretty much already trusted the vendor with that data.

Reply on news.ycombinator.com