Addressing the privacy threat to identify existence of a target’s account on sensitive services

Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Tatsuya Mori

研究成果: Article査読

抄録

Online service providers exert tremendous effort to protect users’ accounts against sensitive data breaches. Although threats from complete outsiders, such as account hijacking for monetization, still occur, recent studies have shed light on threats to privacy from insiders. In this study, we focus on these latter threats. Specifically, we present the first comprehensive study of an attack from insiders that identifies the existence of a target’s account by using the target’s email address and the insecure login-related messages that are displayed. Such a threat may violate intimates’ or acquaintances’ privacy because the kinds of service accounts a user has implies his/her personal preferences or situation. We conducted surveys regarding user expectations and behaviors on online services and an extensive measurement study of login-related messages on online services that are considered sensitive. We found that over 80% of participants answered that they have sensitive services and that almost all services were vulnerable to our attack. Moreover, about half the participants who have sensitive services were insecurely registered on them, thus could be potential victims. Finally, we recommend ways for online service providers to improve login-related messages and for users to take appropriate defensive actions. We also report our responsible disclosure process.

本文言語English
ページ(範囲)1030-1046
ページ数17
ジャーナルJournal of information processing
28
DOI
出版ステータスPublished - 2020 12

ASJC Scopus subject areas

  • コンピュータ サイエンス(全般)

フィンガープリント

「Addressing the privacy threat to identify existence of a target’s account on sensitive services」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル