Surprising Privacy Threats from Innocuous Sensors
Shirish Singh · 2021
Smartphones incorporate a plethora of diverse and powerful sensors that enhance user experience. Two such sensors are accelerometer and gyroscope, which measure acceleration in all three spatial dimensions and rotation along the three axes of the smartphone, respectively. These sensors are often used by gaming and fitness apps. Unlike other sensors deemed to carry sensitive user data, such as GPS, camera, and microphone, the accelerometer and gyroscope do not require user permission on Android. This paper presents our IRB-approved studies showing that the these sensors gather sufficient data to quickly infer user's biological sex within a minute of holding the phone. Other approaches to inferring the user's sex rely directly or indirectly on significantly longer time periods. We started with 36 in-person participants, with 89% accuracy, and followed up with 256 on-line participants to show the effectiveness of our technique. We have implemented our technique as transparent background activities in an Android app, and in a Javascript browser web-app for Android and iOS smartphones. We show that even a low-skilled attacker, without expertise in signal processing or deep learning, can succeed at inferring the user's sex. Our approach is device agnostic and does not require tampering with the victim's device or specialized hardware; all study participants used their own phones.