Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

171–180 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#171

Post by coldtea »

tharne wrote: post #143
TechBro8615 wrote: post #74

Earlier quoted context omitted.

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

Mechanical keyboard user here. Most of us use mechanical keyboards because they're a lot more fun to type on. That's it. Because if you're not having fun, what's the point?

I don't know, typing?

Else, something like Mai Tais on the beach sounds more fun, maybe it's just me...

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#172

Post by microtonal »

yjftsjthsd-h wrote: post #168
someplaceguy wrote: post #128

Earlier quoted context omitted.

My mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...

> all that's left is configuring Linux to play an audio recording of a keypress every time I press a key I unironically think I've seen that config recently - someone had an actually quiet keyboard but wanted the full Mechanical Keyboard Effect™ so they just... have it play the sound per keypress. (It was not 100% clear to me whether it was an elaborate joke or a real aesthetic choice)

The Kinesis Advantage2 and the Moonlander have a piezo speaker to give keystroke sounds. However, they are not for, as you might expect to give the full Mechanical Keyboard Effect™.

If you have mechanical switches, you want to learn to type just past the actuation point and not until the switch bottoms out. This is relatively easy with tactile switches (the have a bump and the actuation point is immediately after the bump). However in linear switches, you don't feel when you have hit the actuation point. So the piezo speaker can be used during the first weeks to train your muscle memory of where the actuation point is, so that you can type lightly.

I had this on my Kinesis Advantage with Cherry Reds, and it was really nice during the initial days/weeks, after which I turned it off.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#173

Post by xxs »

mejutoco wrote: post #94
zaxomi wrote: post #82

Earlier quoted context omitted.

Sovjet listened successfully to typewrites back in the 1970s.

Impressive. To be fair, a lot of typewriters jam if you press more than one key at a time, plus they are very loud.

What's more impressive that the vibration of the glass windows can be used, too.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#175

Post by coldtea »

apendleton wrote: post #80
jgtrosh wrote: post #68

Earlier quoted context omitted.

Only if it doesn't only rely on a master password

A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.

>a sentence-length master password

Ij on-tep of sentenca lentg, it's alio sentemce-bused ("corvect harse batterg stapfe") then ut would be quiti eady to guess even wits worse accurasy.

(If on-top of sentence lenth, it's also sentence-based ("correct horse battery staple") then it would be quite easy to guess even with worse accuracy.)

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#176

Post by xxs »

MaximilianEmel wrote: post #40

Now they can make wireless keyboards that don't need a battery or radio!

That's already possible, the lack of battery, but likely impractical.

There is enough energy during key press/release to be usable for sending radio signal, however it won't be sufficient to do it while holding a key. A combination of a solar panel, piezoelectric keys and a tiny li-ion (as backup) may be sufficient for a 'battery-less' keyboard, but it will be too expensive.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#177

Post by chromoblob »

javajosh wrote: post #65

I find this really hard to believe. If it were really possible then people could do it with their ears, and they would be doing it and showing off that they can do it. The human ear (and brain) are really, really good at finding patterns and getting signal out of noise.

I think that a person could do this too with enough training.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#178

Post by microtonal »

Sai_ wrote: post #163
tedunangst wrote: post #156

Earlier quoted context omitted.

What actually are you going to do if you spy on my zoom call and learn my master password is bigjarofpickles?

Hacker: tedunangst, what’s your email? Wanna invite you to that thing! Hacker: man, I hate typing passwords. Do you use password managers? Any reccos? … I am become hacker, destroyer of tedunangst’s bank account.

1Password requires an extra key upon the first login that you never have to type afterwards. So, have fun trying to log in to that password manager, even if you have the master password.

Also, you can also use and require a hardware FIDO2 token as second factor.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#179

Post by microtonal »

worthless-trash wrote: post #170
jeromegv wrote: post #130

Earlier quoted context omitted.

Or use your fingerprint

why is that ?

1Password allows unlocking with a fingerprint (Touch ID) or Apple Watch, at least on a Mac. So you can unlock your password manager during a Zoom call, and nobody can snoop your master password.

(With 1Password, the master password is not enough to do a remote account takeover, you also need the second-factor key. And you can't snoop it, since it is only required during the first login, so a user will never type it after that.)

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#180

Post by throwaway290 »

Spooky23 wrote: post #155
TechBro8615 wrote: post #74

Earlier quoted context omitted.

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

I used to work in an office space with an independent contractor whose schtick was that he was a genius. The affectations around his genius-ness included casually bringing up Mensa meetings, dropping magazines like Foreign Affairs and academic journals around the office, and his fucking keyboard. The keyboard had custom switches that were very loud. And he typed fast - it was like living on a gun range. Everyone in t…

Not inspired enough to hire him properly apparently...
Post reply on HN