TouchTrack: How unique are your touch gestures?

This paper studies a privacy threat induced by the collection and monitoring of a user's touch gestures on touchscreen devices. The threat is a new form of persistent tracking which we refer to as touch-based trackingž. It goes beyond tracking of virtual identities and has the potential for cross-device tracking as well as identifying multiple users using the same device. To demonstrate the likelihood of touch-based tracking, we propose an information theoretic method that quantiies the amount of information revealed by individual features of gestures, samples of gestures as well as samples of gesture combinations, when modelled as feature vectors. We have also developed a purpose-built app, named TouchTrackž that collects data from users and informs them on how unique they are when interacting with their touch devices. Our results from 89 diferent users indicate that writing samples and left swipes can reveal 73.7% and 68.6% of user information, respectively. Combining diferent combinations of gestures results in higher uniqueness, with the combination of keystrokes, swipes and writing revealing up to 98.5% of information about users. We correctly re-identify returning users with a success rate of more than 90%.