Addressing the privacy threat to identify existence of a target’s account on sensitive services

Ayako Akiyama Hasegawa, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Tatsuya Mori

研究成果: Article査読


Online service providers exert tremendous effort to protect users’ accounts against sensitive data breaches. Although threats from complete outsiders, such as account hijacking for monetization, still occur, recent studies have shed light on threats to privacy from insiders. In this study, we focus on these latter threats. Specifically, we present the first comprehensive study of an attack from insiders that identifies the existence of a target’s account by using the target’s email address and the insecure login-related messages that are displayed. Such a threat may violate intimates’ or acquaintances’ privacy because the kinds of service accounts a user has implies his/her personal preferences or situation. We conducted surveys regarding user expectations and behaviors on online services and an extensive measurement study of login-related messages on online services that are considered sensitive. We found that over 80% of participants answered that they have sensitive services and that almost all services were vulnerable to our attack. Moreover, about half the participants who have sensitive services were insecurely registered on them, thus could be potential victims. Finally, we recommend ways for online service providers to improve login-related messages and for users to take appropriate defensive actions. We also report our responsible disclosure process.

ジャーナルJournal of information processing
出版ステータスPublished - 2020 12月

ASJC Scopus subject areas

  • コンピュータ サイエンス(全般)


「Addressing the privacy threat to identify existence of a target’s account on sensitive services」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。