  This paper proposes the first user-independent inter-keystroke timing attacks
on PINs. Our attack method is based on an inter-keystroke timing dictionary
built from a human cognitive model whose parameters can be determined by a
small amount of training data on any users (not necessarily the target
victims). Our attacks can thus be potentially launched on a large scale in
real-world settings. We investigate inter-keystroke timing attacks in different
online attack settings and evaluate their performance on PINs at different
strength levels. Our experimental results show that the proposed attack
performs significantly better than random guessing attacks. We further
demonstrate that our attacks pose a serious threat to real-world applications
and propose various ways to mitigate the threat.
