3 ms·

Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?

pbhjpbhj 7y ago
I imagine it could be a useful signal - most "touch" on a particular key at the instant the accelerometer gives largest jerk ... might help to avoid false keying?
wcoenen 7y ago
Are we sure that it doesn't? This news is from 7 years ago.
adrianmonk 7y ago
It's probably not that simple and clear cut. There are probably some reasonable use cases for apps that need the accelerometer on continuously. Which makes it a trade-off. One example could be a pedometer / activity tracker app that totals up your number of steps per day. Suppose the user decides to get on a treadmill and walk for 30 minutes but finds it boring so they text their friends while doing it. Maybe they have the keyboard open the entire time, so at the end of their 30 minutes of exercise, the pedometer registers zero activity. Or maybe you have an app that uses certain accelerometer-based gestures to trigger certain actions. If Android gets an update that turns off the accelerometer when the keyboard is open, many users won't understand why the gesture only works sometimes, and the app developer will get a ton of bug reports. And you'd be creating these potential problems to solve a privacy leak which doesn't seem that severe given that it can only give you weak information about a person's pin. I'm not saying that shutting off the accelerometer isn't ultimately the right decision, but I am saying it's not a no-brainer.
- angry_octet 7y ago
  Doesn't Android know when the user is authenticating? How many seconds a day are you inputting to the lock screen? Doesn't need to be for any time the keyboard is open. (Of course, doing it semi randomly is also now necessary, to obscure user unlock times.) As to weak info, you do it again and again, I'd say it's pretty good info.
  - adrianmonk 7y ago
    If you're only trying to solve the very narrow problem of entering a PIN to authenticate to the system, then sure. When you said "during keyboard input", I thought you were being more general, but I suppose you must have meant during keyboard input of the system PIN. I don't think that PIN is the only sensitive information that matters, though. Android supports a numeric keypad input mode for apps. If I'm entering my credit card number into some app (Lyft, Amazon Shopping, etc.), that seems pretty sensitive. Maybe more sensitive than the system PIN even, because if I know your system PIN, I can't necessarily do anything with it unless I have physical access to your device or you've re-used the same PIN elsewhere.
Razengan 7y ago
I wish iOS didn't show each character as you type your password. HOW is that even helpful, let alone not having an option to disable that?
- uniformlyrandom 7y ago
  It is kind of helpful, but I agree that it should be an opt-in in accessibility settings.
- fiddlerwoaroof 7y ago
  I use it all the time to correct password mistakes: I would be really irritated if that went away: in fact, I frequently use devtools on my laptop to change password inputs to text inputs

I imagine it could be a useful signal - most "touch" on a particular key at the instant the accelerometer gives largest jerk ... might help to avoid false keying?

wcoenen 7y ago

Are we sure that it doesn't? This news is from 7 years ago.

adrianmonk 7y ago

It's probably not that simple and clear cut. There are probably some reasonable use cases for apps that need the accelerometer on continuously. Which makes it a trade-off. One example could be a pedometer / activity tracker app that totals up your number of steps per day. Suppose the user decides to get on a treadmill and walk for 30 minutes but finds it boring so they text their friends while doing it. Maybe they have the keyboard open the entire time, so at the end of their 30 minutes of exercise, the pedometer registers zero activity. Or maybe you have an app that uses certain accelerometer-based gestures to trigger certain actions. If Android gets an update that turns off the accelerometer when the keyboard is open, many users won't understand why the gesture only works sometimes, and the app developer will get a ton of bug reports. And you'd be creating these potential problems to solve a privacy leak which doesn't seem that severe given that it can only give you weak information about a person's pin. I'm not saying that shutting off the accelerometer isn't ultimately the right decision, but I am saying it's not a no-brainer.

angry_octet 7y ago
Doesn't Android know when the user is authenticating? How many seconds a day are you inputting to the lock screen? Doesn't need to be for any time the keyboard is open. (Of course, doing it semi randomly is also now necessary, to obscure user unlock times.) As to weak info, you do it again and again, I'd say it's pretty good info.
- adrianmonk 7y ago
  If you're only trying to solve the very narrow problem of entering a PIN to authenticate to the system, then sure. When you said "during keyboard input", I thought you were being more general, but I suppose you must have meant during keyboard input of the system PIN. I don't think that PIN is the only sensitive information that matters, though. Android supports a numeric keypad input mode for apps. If I'm entering my credit card number into some app (Lyft, Amazon Shopping, etc.), that seems pretty sensitive. Maybe more sensitive than the system PIN even, because if I know your system PIN, I can't necessarily do anything with it unless I have physical access to your device or you've re-used the same PIN elsewhere.

Razengan 7y ago

I wish iOS didn't show each character as you type your password. HOW is that even helpful, let alone not having an option to disable that?

uniformlyrandom 7y ago
It is kind of helpful, but I agree that it should be an opt-in in accessibility settings.
fiddlerwoaroof 7y ago
I use it all the time to correct password mistakes: I would be really irritated if that went away: in fact, I frequently use devtools on my laptop to change password inputs to text inputs