The example figure shows a key hit every half second, which suggests a pecking style of typing at around 24 wpm. This way the model gets very clean waveforms. I wonder how their approach would work with average or fast typists. The sound profiles might be much harder to link to characters.
New acoustic attack steals data from keystrokes with 95% accuracy
51–60 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#52Using an image classifier on spectrograms is pretty funny. Not a bad idea, given image classifiers are dime a dozen, but still.
It's actually quite common. One of the big bird recognition apps does just this.
There are multiple apps for this? Seems like PBS KIDS should own the authoritative one, and the licensing.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#53I think about this attack when streamers on Twitch logs into websites etc.
I think an attacker would find that many streamers with high quality audio have properly setup their mics with noise gate filters to remove their relatively quiet keystrokes.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#54Earlier quoted context omitted.
Or just use 2fa
If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is ba…
Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#55Timing attacks have been attack vector for a while? I remember reading a tool on HN a couple years ago about it. You don’t even need audio, the rate of which you enter the keys into the password field is enough.
How do you get the rate?
Maybe any one of your browser tabs has JS listening to the accelerometer. It doesn't even require a permission, AFAIK.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#56Re: New acoustic attack steals data from keystrokes with 95% accuracy
#57i use 1password and have never ever typed password, so i am probably safe.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#58Would love a wireless keyboard that works using this! It wouldn’t need any battery, charging or syncing!
Some old TV remotes used to work this way. They were made by Zenith and are called Space Command remotes. Apparently they are the reason TV remotes are sometimes called clickers.
https://www.theverge.com/23810061/zenith-space-command-remot...
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#59Timing attacks have been attack vector for a while? I remember reading a tool on HN a couple years ago about it. You don’t even need audio, the rate of which you enter the keys into the password field is enough.
I seriously doubt that.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#60Earlier quoted context omitted.
Some places use touchscreen keypads for PIN entry exactly for this reason: to allow randomization, e.g. for opening a locked door, or for authorizing a transaction.
Do they randomize the key locations though? Otherwise, you leave behind grease where your fingers touched
[deleted]