Sensor-based Mobile Web Fingerprinting and Cross-site Input Inference Attacks

Smartphone motion sensor data are not only accessible to native mobile apps, but have also become accessible to the webpages rendered in either mobile browsers or the WebView components of mobile apps. In this position paper, we highlight four types of broad and severe user fingerprinting and cross-site input inference attacks that can exploit the smartphone motion sensor data to compromise mobile web users' privacy and security; we also discuss some research topics for further investigating the effectiveness of these attacks and designing usable defense mechanisms.