Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#31

Post by ben_w »

raincole wrote: post #22
bqmjjx0kac wrote: post #10

Earlier quoted context omitted.

This is just security through obscurity. For real security, you need a cryptographically rolling keyboard layout.

Why not just a keyboard that produces random noise?

Finally, a use for Buffy's Swearing Keyboard.

Or possibly the exact opposite of that, I can't tell if it's a one-to-one mapping on mobile: https://www2.b3ta.com/buffyswear/

(Also, I'm feeling my age now, given how many years have elapsed since that kind of thing passed for internet culture…)

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#34

Post by frant-hartm »

insickness wrote: post #11

Zoom is good at filtering out rather loud background noises. I can't imagine that the sound of background typing during a conversation could be detected by the other party.

What? Zoom (by default with auto mic adjustment) catches everything. Typing on laptop is especially bad as it is closer to the mic than the person speaking (unless there is external mic), so it's like a stampede of rhinos.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#35

Post by hoosieree »

WXLCKNO wrote: post #19

Time to inject background audio of me typing "fuck you" into my zoom calls.

Text-to-keystroke-audio where the text comes from the LLM Prompt "fanfiction based on HGTV's Love It or List It starring an Ewok realtor and Klingon interior designer in iambic pentameter".

The goal is to cause the eavesdropper to totally reevaluate their life choices, and maybe even get caught up in the story.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#36

Post by yowzadave »

OtherShrezzing wrote: post #29
lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

I guess more reason to just use a password manager to autofill your password?

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#37

Post by raffraffraff »

bqmjjx0kac wrote: post #10
thedookmaster wrote: post #7

I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.

This is just security through obscurity. For real security, you need a cryptographically rolling keyboard layout.

My sister in law uses voice recognition and dictation software, so she doesn't even use a keyboard! Totally safe!

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#39

Post by kypro »

yowzadave wrote: post #36
OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

I guess more reason to just use a password manager to autofill your password?

Or just use 2fa
Post reply on HN