i use 1password and have never ever typed password, so i am probably safe.
Two words for you: Master password.
New acoustic attack steals data from keystrokes with 95% accuracy
71–80 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#72New? Sovjet listened to typewriters in the 1970s.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#73Georgi Gerganov created one a few years ago
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#74So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#75So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
It's for a targeted attack. It doesn't need to be generalized.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#76I find this really hard to believe. If it were really possible then people could do it with their ears, and they would be doing it and showing off that they can do it. The human ear (and brain) are really, really good at finding patterns and getting signal out of noise.
You're really surprised that computers can outperform humans at pattern recognition?
Yes. Humans have fantastic audio and video processing abilities, particularly picking out signal from noise. Even now human operators listen to sonar signals on submarines. There's a reason for that.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#77Earlier quoted context omitted.
I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#78Time to inject background audio of me typing "fuck you" into my zoom calls.
Tactical noise!
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#79But what passwords are you typing while on zoom and why aren't you on mute?
When calling my cellular/internet/medical/financial provider, it might be interesting to "see" what they are typing. (Or if they're randomly surfing the internet.)
How long are you talking to them that you've been able to record samples of the sound of all their keystrokes and perform this analysis?
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#80Earlier quoted context omitted.
I guess more reason to just use a password manager to autofill your password?
Only if it doesn't only rely on a master password
A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.