Addressing the privacy threat to identify existence of a target’s account on sensitive services

Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Tatsuya Mori

Research output: Contribution to journalArticlepeer-review

Abstract

Online service providers exert tremendous effort to protect users’ accounts against sensitive data breaches. Although threats from complete outsiders, such as account hijacking for monetization, still occur, recent studies have shed light on threats to privacy from insiders. In this study, we focus on these latter threats. Specifically, we present the first comprehensive study of an attack from insiders that identifies the existence of a target’s account by using the target’s email address and the insecure login-related messages that are displayed. Such a threat may violate intimates’ or acquaintances’ privacy because the kinds of service accounts a user has implies his/her personal preferences or situation. We conducted surveys regarding user expectations and behaviors on online services and an extensive measurement study of login-related messages on online services that are considered sensitive. We found that over 80% of participants answered that they have sensitive services and that almost all services were vulnerable to our attack. Moreover, about half the participants who have sensitive services were insecurely registered on them, thus could be potential victims. Finally, we recommend ways for online service providers to improve login-related messages and for users to take appropriate defensive actions. We also report our responsible disclosure process.

Original languageEnglish
Pages (from-to)1030-1046
Number of pages17
JournalJournal of information processing
Volume28
DOIs
Publication statusPublished - 2020 Dec

Keywords

  • Account security
  • Insider attack
  • Login
  • Privacy
  • Usable security

ASJC Scopus subject areas

  • Computer Science(all)

Fingerprint Dive into the research topics of 'Addressing the privacy threat to identify existence of a target’s account on sensitive services'. Together they form a unique fingerprint.

Cite this