Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#101

Post by koolba »

apendleton wrote: post #80
jgtrosh wrote: post #68

Earlier quoted context omitted.

Only if it doesn't only rely on a master password

A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.

The master password is also offline and require the key file to u lock the rest of the passwords. So by itself it’s not enough to compromise the accounts in the key file. The attacker would need the key file as well.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#102

Post by Guvante »

jgtrosh wrote: post #68
yowzadave wrote: post #36

Earlier quoted context omitted.

I guess more reason to just use a password manager to autofill your password?

Only if it doesn't only rely on a master password

Doesn't everybody not require only a password?

Offline you need the database which isn't public.

Online you usually need something else on new machines to get at the true master password.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#103

Post by metaphor »

tehsauce wrote: post #33

Would love a wireless keyboard that works using this! It wouldn’t need any battery, charging or syncing!

Imagine the UX of 1 in 20 characters typed being incorrectly inferred though. The P_failure*Cost impact would strike me as insufferable even if error rate were to improve by an order of magnitude.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#104

Post by crazygringo »

frant-hartm wrote: post #34
insickness wrote: post #11

Zoom is good at filtering out rather loud background noises. I can't imagine that the sound of background typing during a conversation could be detected by the other party.

What? Zoom (by default with auto mic adjustment) catches everything. Typing on laptop is especially bad as it is closer to the mic than the person speaking (unless there is external mic), so it's like a stampede of rhinos.

It shouldn't. Auto (the default) is designed to filter out keystrokes along with other noises, precisely because typing on the laptop is horrible for the reason you mention.

Keystrokes should only be a problem when noise suppression is set to low/off, which you want to do for e.g. playing music.

But noise suppression is applied to sending audio, not receiving it. So you might need to tell your coworkers to re-enable their noise suppression.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#106

Post by bitshiftfaced »

OtherShrezzing wrote: post #29
lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

I think maybe you wouldn't even need to see the keystrokes. Given enough examples of just audio, I wonder if you could work out the keys using the statistical letter patterns in language.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#107

Post by llbeansandrice »

TheCleric wrote: post #100
belval wrote: post #98

Earlier quoted context omitted.

95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatter…

On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.

Right. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password.

You don’t need to guess every character.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#108

Post by idbehold »

TheCleric wrote: post #99
thereisnospork wrote: post #81

Earlier quoted context omitted.

What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.

Adding a gain knob to my keyboard, be right back.

When conducting coding interviews remotely I often switch from my mechanical keyboard to my laptop keyboard (for taking notes) because I know how annoying/distracting that sound can be on calls. Suffice it to say, having a gain knob on my mechanical keyboard would be wonderful.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#109

Post by whelp_24 »

TheCleric wrote: post #100
belval wrote: post #98

Earlier quoted context omitted.

95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatter…

On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.

that's pretty high when you can use a computer to run the guesses
Post reply on HN