{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:4BG677LQITLA6AGDGQA7RT523T","short_pith_number":"pith:4BG677LQ","canonical_record":{"source":{"id":"1602.04115","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-02-12T16:44:55Z","cross_cats_sorted":[],"title_canon_sha256":"cacadc0f71f479fe9ec9814236f9e205420585a31951268de3680a4936d53be0","abstract_canon_sha256":"be9395ebf668d4c2cd0849715b35d995b429ec7ea7f69b7177ed1abbb5a162af"},"schema_version":"1.0"},"canonical_sha256":"e04deffd7044d60f00c33401f8cfbadcf7d99c27281a99b611ee743fc6258231","source":{"kind":"arxiv","id":"1602.04115","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1602.04115","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"arxiv_version","alias_value":"1602.04115v1","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1602.04115","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"pith_short_12","alias_value":"4BG677LQITLA","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_16","alias_value":"4BG677LQITLA6AGD","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_8","alias_value":"4BG677LQ","created_at":"2026-05-18T12:29:58Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:4BG677LQITLA6AGDGQA7RT523T","target":"record","payload":{"canonical_record":{"source":{"id":"1602.04115","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-02-12T16:44:55Z","cross_cats_sorted":[],"title_canon_sha256":"cacadc0f71f479fe9ec9814236f9e205420585a31951268de3680a4936d53be0","abstract_canon_sha256":"be9395ebf668d4c2cd0849715b35d995b429ec7ea7f69b7177ed1abbb5a162af"},"schema_version":"1.0"},"canonical_sha256":"e04deffd7044d60f00c33401f8cfbadcf7d99c27281a99b611ee743fc6258231","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T01:15:49.641050Z","signature_b64":"zvw4Ushjax7rR+wCoGNxwof1OKi9rw5BGPIGEsp6lH7tWipgPPcBECN7sfQCPT3usi2Ckg49uFxWc+rAQ0lhDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"e04deffd7044d60f00c33401f8cfbadcf7d99c27281a99b611ee743fc6258231","last_reissued_at":"2026-05-18T01:15:49.640366Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T01:15:49.640366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1602.04115","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:15:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"K0ubqnfQc3vOxgnbb2DpSYbcDemVyatsS/jpfg7YAHWd9PiGrvDR+aNonCNaUdotj5+3jWS7VOhupuDH18eHDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T18:48:25.616907Z"},"content_sha256":"cccd9260078a218918d507a6e1f21745befb19a6e6ee13b059aee775bda27159","schema_version":"1.0","event_id":"sha256:cccd9260078a218918d507a6e1f21745befb19a6e6ee13b059aee775bda27159"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:4BG677LQITLA6AGDGQA7RT523T","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"TouchSignatures: Identification of User Touch Actions and PINs Based on Mobile Sensor Data via JavaScript","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ehsan Toreini, Feng Hao, Maryam Mehrnezhad, Siamak F. Shahandashti","submitted_at":"2016-02-12T16:44:55Z","abstract_excerpt":"Conforming to W3C specifications, mobile web browsers allow JavaScript code in a web page to access motion and orientation sensor data without the user's permission. The associated risks to user security and privacy are however not considered in W3C specifications. In this work, for the first time, we show how user security can be compromised using these sensor data via browser, despite that the data rate is 3 to 5 times slower than what is available in app. We examine multiple popular browsers on Android and iOS platforms and study their policies in granting permissions to JavaScript code wit"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1602.04115","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:15:49Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2Nhg3Z5K6/EiLJEsdQfQ98ugCGYvA7RZx3RshxjZ2CLzO2VCdEZ7cncslstjgWxHI4Sv0K9//YnzBNOTJII+Dw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T18:48:25.617587Z"},"content_sha256":"4d6769cbbbef8410d56a02be013859b3b397846099a466c048a6e289c3324faf","schema_version":"1.0","event_id":"sha256:4d6769cbbbef8410d56a02be013859b3b397846099a466c048a6e289c3324faf"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/4BG677LQITLA6AGDGQA7RT523T/bundle.json","state_url":"https://pith.science/pith/4BG677LQITLA6AGDGQA7RT523T/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/4BG677LQITLA6AGDGQA7RT523T/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T18:48:25Z","links":{"resolver":"https://pith.science/pith/4BG677LQITLA6AGDGQA7RT523T","bundle":"https://pith.science/pith/4BG677LQITLA6AGDGQA7RT523T/bundle.json","state":"https://pith.science/pith/4BG677LQITLA6AGDGQA7RT523T/state.json","well_known_bundle":"https://pith.science/.well-known/pith/4BG677LQITLA6AGDGQA7RT523T/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:4BG677LQITLA6AGDGQA7RT523T","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"be9395ebf668d4c2cd0849715b35d995b429ec7ea7f69b7177ed1abbb5a162af","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-02-12T16:44:55Z","title_canon_sha256":"cacadc0f71f479fe9ec9814236f9e205420585a31951268de3680a4936d53be0"},"schema_version":"1.0","source":{"id":"1602.04115","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1602.04115","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"arxiv_version","alias_value":"1602.04115v1","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1602.04115","created_at":"2026-05-18T01:15:49Z"},{"alias_kind":"pith_short_12","alias_value":"4BG677LQITLA","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_16","alias_value":"4BG677LQITLA6AGD","created_at":"2026-05-18T12:29:58Z"},{"alias_kind":"pith_short_8","alias_value":"4BG677LQ","created_at":"2026-05-18T12:29:58Z"}],"graph_snapshots":[{"event_id":"sha256:4d6769cbbbef8410d56a02be013859b3b397846099a466c048a6e289c3324faf","target":"graph","created_at":"2026-05-18T01:15:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"Conforming to W3C specifications, mobile web browsers allow JavaScript code in a web page to access motion and orientation sensor data without the user's permission. The associated risks to user security and privacy are however not considered in W3C specifications. In this work, for the first time, we show how user security can be compromised using these sensor data via browser, despite that the data rate is 3 to 5 times slower than what is available in app. We examine multiple popular browsers on Android and iOS platforms and study their policies in granting permissions to JavaScript code wit","authors_text":"Ehsan Toreini, Feng Hao, Maryam Mehrnezhad, Siamak F. Shahandashti","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-02-12T16:44:55Z","title":"TouchSignatures: Identification of User Touch Actions and PINs Based on Mobile Sensor Data via JavaScript"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1602.04115","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cccd9260078a218918d507a6e1f21745befb19a6e6ee13b059aee775bda27159","target":"record","created_at":"2026-05-18T01:15:49Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"be9395ebf668d4c2cd0849715b35d995b429ec7ea7f69b7177ed1abbb5a162af","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-02-12T16:44:55Z","title_canon_sha256":"cacadc0f71f479fe9ec9814236f9e205420585a31951268de3680a4936d53be0"},"schema_version":"1.0","source":{"id":"1602.04115","kind":"arxiv","version":1}},"canonical_sha256":"e04deffd7044d60f00c33401f8cfbadcf7d99c27281a99b611ee743fc6258231","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"e04deffd7044d60f00c33401f8cfbadcf7d99c27281a99b611ee743fc6258231","first_computed_at":"2026-05-18T01:15:49.640366Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T01:15:49.640366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"zvw4Ushjax7rR+wCoGNxwof1OKi9rw5BGPIGEsp6lH7tWipgPPcBECN7sfQCPT3usi2Ckg49uFxWc+rAQ0lhDQ==","signature_status":"signed_v1","signed_at":"2026-05-18T01:15:49.641050Z","signed_message":"canonical_sha256_bytes"},"source_id":"1602.04115","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cccd9260078a218918d507a6e1f21745befb19a6e6ee13b059aee775bda27159","sha256:4d6769cbbbef8410d56a02be013859b3b397846099a466c048a6e289c3324faf"],"state_sha256":"f2951611baf9b8afc7a62973fa2d85d598702c138e5143d12e740d73f0b60831"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"UUdYX84b9FTUJ4JcbTyZXXasdOW9fidP9WCk4uXJmJwJdLI2Ist5vvELkjyTMzUNTOes1QpxnzVtm9vwT+bvCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T18:48:25.623664Z","bundle_sha256":"cdd5403ae8f42559653e6451175949cbdbed99a41df6171bf69e85bc3339610e"}}