{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:CNNTIDR25UPGXAPWQJE5GCNZ5M","short_pith_number":"pith:CNNTIDR2","canonical_record":{"source":{"id":"1605.05549","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-05-18T12:27:00Z","cross_cats_sorted":[],"title_canon_sha256":"dca4a88bdb3e5447601c022547d66783a687788212c6aa2b20b3f476262c2364","abstract_canon_sha256":"c2cee04e81c0060661422601adc1495ca6843b2103cc81101f8069b892d83ef5"},"schema_version":"1.0"},"canonical_sha256":"135b340e3aed1e6b81f68249d309b9eb21866f5a61819277e077fa9558b4ab15","source":{"kind":"arxiv","id":"1605.05549","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1605.05549","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"arxiv_version","alias_value":"1605.05549v2","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1605.05549","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"pith_short_12","alias_value":"CNNTIDR25UPG","created_at":"2026-05-18T12:30:09Z"},{"alias_kind":"pith_short_16","alias_value":"CNNTIDR25UPGXAPW","created_at":"2026-05-18T12:30:09Z"},{"alias_kind":"pith_short_8","alias_value":"CNNTIDR2","created_at":"2026-05-18T12:30:09Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:CNNTIDR25UPGXAPWQJE5GCNZ5M","target":"record","payload":{"canonical_record":{"source":{"id":"1605.05549","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-05-18T12:27:00Z","cross_cats_sorted":[],"title_canon_sha256":"dca4a88bdb3e5447601c022547d66783a687788212c6aa2b20b3f476262c2364","abstract_canon_sha256":"c2cee04e81c0060661422601adc1495ca6843b2103cc81101f8069b892d83ef5"},"schema_version":"1.0"},"canonical_sha256":"135b340e3aed1e6b81f68249d309b9eb21866f5a61819277e077fa9558b4ab15","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T00:46:16.714053Z","signature_b64":"tPqUmp6hQGkM6sKrzzeKbvtElnBOc4LhlvkSePbvG5S5AlNDB+SRahZiD2cJAHDFpXWwexnfSdy3Y/A3pJB3Aw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"135b340e3aed1e6b81f68249d309b9eb21866f5a61819277e077fa9558b4ab15","last_reissued_at":"2026-05-18T00:46:16.713660Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T00:46:16.713660Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1605.05549","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:46:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"XHxEWwFkInjdHUuVQatautYYb2udPpvRbVjLXJJFqk2nTldEgz+d5MKyqgrG1fz5tgjo2U+C9u/0hlMCQ0+CDw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T18:12:35.342382Z"},"content_sha256":"b88b0bb327e7d4b37ca200fdbf10530fd86773b9f4c6f776af5ca0d92e60e8aa","schema_version":"1.0","event_id":"sha256:b88b0bb327e7d4b37ca200fdbf10530fd86773b9f4c6f776af5ca0d92e60e8aa"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:CNNTIDR25UPGXAPWQJE5GCNZ5M","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Stealing PINs via Mobile Sensors: Actual Risk versus User Perception","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ehsan Toreini, Feng Hao, Maryam Mehrnezhad, Siamak F. Shahandashti","submitted_at":"2016-05-18T12:27:00Z","abstract_excerpt":"In this paper, we present the actual risks of stealing user PINs by using mobile sensors versus the perceived risks by users. First, we propose PINlogger.js which is a JavaScript-based side channel attack revealing user PINs on an Android mobile phone. In this attack, once the user visits a website controlled by an attacker, the JavaScript code embedded in the web page starts listening to the motion and orientation sensor streams without needing any permission from the user. By analysing these streams, it infers the user's PIN using an artificial neural network. Based on a test set of fifty 4-"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1605.05549","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T00:46:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"1nbEj+NqIDJxbVGOijtH7K9AZmi0Wi11CjoZMHiyec53/uORsg5MxP3fDicxnbSleVp9p5j9vHEKZYHUElQSAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T18:12:35.343139Z"},"content_sha256":"044d520fa69f4bf0f5fd087e103b7256a2ecc237d82ce0e6a8ed06763071210b","schema_version":"1.0","event_id":"sha256:044d520fa69f4bf0f5fd087e103b7256a2ecc237d82ce0e6a8ed06763071210b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/bundle.json","state_url":"https://pith.science/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T18:12:35Z","links":{"resolver":"https://pith.science/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M","bundle":"https://pith.science/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/bundle.json","state":"https://pith.science/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/state.json","well_known_bundle":"https://pith.science/.well-known/pith/CNNTIDR25UPGXAPWQJE5GCNZ5M/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:CNNTIDR25UPGXAPWQJE5GCNZ5M","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"c2cee04e81c0060661422601adc1495ca6843b2103cc81101f8069b892d83ef5","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-05-18T12:27:00Z","title_canon_sha256":"dca4a88bdb3e5447601c022547d66783a687788212c6aa2b20b3f476262c2364"},"schema_version":"1.0","source":{"id":"1605.05549","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1605.05549","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"arxiv_version","alias_value":"1605.05549v2","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1605.05549","created_at":"2026-05-18T00:46:16Z"},{"alias_kind":"pith_short_12","alias_value":"CNNTIDR25UPG","created_at":"2026-05-18T12:30:09Z"},{"alias_kind":"pith_short_16","alias_value":"CNNTIDR25UPGXAPW","created_at":"2026-05-18T12:30:09Z"},{"alias_kind":"pith_short_8","alias_value":"CNNTIDR2","created_at":"2026-05-18T12:30:09Z"}],"graph_snapshots":[{"event_id":"sha256:044d520fa69f4bf0f5fd087e103b7256a2ecc237d82ce0e6a8ed06763071210b","target":"graph","created_at":"2026-05-18T00:46:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"In this paper, we present the actual risks of stealing user PINs by using mobile sensors versus the perceived risks by users. First, we propose PINlogger.js which is a JavaScript-based side channel attack revealing user PINs on an Android mobile phone. In this attack, once the user visits a website controlled by an attacker, the JavaScript code embedded in the web page starts listening to the motion and orientation sensor streams without needing any permission from the user. By analysing these streams, it infers the user's PIN using an artificial neural network. Based on a test set of fifty 4-","authors_text":"Ehsan Toreini, Feng Hao, Maryam Mehrnezhad, Siamak F. Shahandashti","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-05-18T12:27:00Z","title":"Stealing PINs via Mobile Sensors: Actual Risk versus User Perception"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1605.05549","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b88b0bb327e7d4b37ca200fdbf10530fd86773b9f4c6f776af5ca0d92e60e8aa","target":"record","created_at":"2026-05-18T00:46:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"c2cee04e81c0060661422601adc1495ca6843b2103cc81101f8069b892d83ef5","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-05-18T12:27:00Z","title_canon_sha256":"dca4a88bdb3e5447601c022547d66783a687788212c6aa2b20b3f476262c2364"},"schema_version":"1.0","source":{"id":"1605.05549","kind":"arxiv","version":2}},"canonical_sha256":"135b340e3aed1e6b81f68249d309b9eb21866f5a61819277e077fa9558b4ab15","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"135b340e3aed1e6b81f68249d309b9eb21866f5a61819277e077fa9558b4ab15","first_computed_at":"2026-05-18T00:46:16.713660Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T00:46:16.713660Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"tPqUmp6hQGkM6sKrzzeKbvtElnBOc4LhlvkSePbvG5S5AlNDB+SRahZiD2cJAHDFpXWwexnfSdy3Y/A3pJB3Aw==","signature_status":"signed_v1","signed_at":"2026-05-18T00:46:16.714053Z","signed_message":"canonical_sha256_bytes"},"source_id":"1605.05549","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b88b0bb327e7d4b37ca200fdbf10530fd86773b9f4c6f776af5ca0d92e60e8aa","sha256:044d520fa69f4bf0f5fd087e103b7256a2ecc237d82ce0e6a8ed06763071210b"],"state_sha256":"830bbb0345008734f694b645217ad227350bb82fa78c1f4323b78878abf31b60"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Hjp0jcldSX0PYKLtzs5IFHLyPEbFzQFKfaEsFpPM5LzSxFZAYuAe9rgA8O7mL9Yh3kPLgdmKjysMpuarA6SuAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T18:12:35.349204Z","bundle_sha256":"b09302072f6b6dc7b306050f4830c0e7d2afdf08d0e1a13405268304b02d85af"}}