Addressing the Privacy Threat to Identify Existence of a Target's Account on Sensitive Services

• Item type: Journal(1)
• 公開日: 2020-12-15
• タイトル: Addressing the Privacy Threat to Identify Existence of a Target's Account on Sensitive Services
• タイトル / 言語: en
• タイトル: Addressing the Privacy Threat to Identify Existence of a Target's Account on Sensitive Services
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: [特集：ユーザブルセキュリティ] usable security, account security, privacy, insider attack, login
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_6501
• 資源タイプ: journal article
• 著者所属: NTT Secure Platform Laboratories
• 著者所属: NTT Secure Platform Laboratories
• 著者所属: NTT Secure Platform Laboratories
• 著者所属: NTT Secure Platform Laboratories
• 著者所属: Waseda University／NICT／RIKEN AIP
• 著者所属(英): en
• 著者所属(英): NTT Secure Platform Laboratories
• 著者所属(英): en
• 著者所属(英): NTT Secure Platform Laboratories
• 著者所属(英): en
• 著者所属(英): NTT Secure Platform Laboratories
• 著者所属(英): en
• 著者所属(英): NTT Secure Platform Laboratories
• 著者所属(英): en
• 著者所属(英): Waseda University / NICT / RIKEN AIP
• 著者名: Ayako, Akiyama Hasegawa; Takuya, Watanabe; Eitaro, Shioji; Mitsuaki, Akiyama; Tatsuya, Mori
• 著者名(英): Ayako, Akiyama Hasegawa; Takuya, Watanabe; Eitaro, Shioji; Mitsuaki, Akiyama; Tatsuya, Mori
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Online service providers exert tremendous effort to protect users' accounts against sensitive data breaches. Although threats from complete outsiders, such as account hijacking for monetization, still occur, recent studies have shed light on threats to privacy from insiders. In this study, we focus on these latter threats. Specifically, we present the first comprehensive study of an attack from insiders that identifies the existence of a target's account by using the target's email address and the insecure login-related messages that are displayed. Such a threat may violate intimates' or acquaintances' privacy because the kinds of service accounts a user has implies his/her personal preferences or situation. We conducted surveys regarding user expectations and behaviors on online services and an extensive measurement study of login-related messages on online services that are considered sensitive. We found that over 80% of participants answered that they have sensitive services and that almost all services were vulnerable to our attack. Moreover, about half the participants who have sensitive services were insecurely registered on them, thus could be potential victims. Finally, we recommend ways for online service providers to improve login-related messages and for users to take appropriate defensive actions. We also report our responsible disclosure process.; ------------------------------; This is a preprint of an article intended for publication Journal of; Information Processing(JIP). This preprint should not be cited. This; article should be cited as: Journal of Information Processing Vol.28(2020) (online); DOI http://dx.doi.org/10.2197/ipsjjip.28.1030; ------------------------------
• 論文抄録(英) / 内容記述タイプ: Other
• 論文抄録(英) / 内容記述: Online service providers exert tremendous effort to protect users' accounts against sensitive data breaches. Although threats from complete outsiders, such as account hijacking for monetization, still occur, recent studies have shed light on threats to privacy from insiders. In this study, we focus on these latter threats. Specifically, we present the first comprehensive study of an attack from insiders that identifies the existence of a target's account by using the target's email address and the insecure login-related messages that are displayed. Such a threat may violate intimates' or acquaintances' privacy because the kinds of service accounts a user has implies his/her personal preferences or situation. We conducted surveys regarding user expectations and behaviors on online services and an extensive measurement study of login-related messages on online services that are considered sensitive. We found that over 80% of participants answered that they have sensitive services and that almost all services were vulnerable to our attack. Moreover, about half the participants who have sensitive services were insecurely registered on them, thus could be potential victims. Finally, we recommend ways for online service providers to improve login-related messages and for users to take appropriate defensive actions. We also report our responsible disclosure process.; ------------------------------; This is a preprint of an article intended for publication Journal of; Information Processing(JIP). This preprint should not be cited. This; article should be cited as: Journal of Information Processing Vol.28(2020) (online); DOI http://dx.doi.org/10.2197/ipsjjip.28.1030; ------------------------------
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AN00116647
• 書誌情報: 情報処理学会論文誌; 巻 61, 号 12, 発行日 2020-12-15
• ISSN / 収録物識別子タイプ: ISSN
• ISSN / 収録物識別子: 1882-7764