Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

211–220 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#211
This idea could also be used for good at some point. Imagine “connecting” any keyboard to a device just by enabling the microphone.

It would have its own set of problems: not two people using it at once, eavesdropping would be really easy… but it’d have its own set of interesting applications

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#212

Earlier quoted context omitted.

> a sentence-length master password Ij on-tep of sentenca lentg, it's alio sentemce-bused ("corvect harse batterg stapfe") then ut would be quiti eady to guess even wits worse accurasy. (If on-top of sentence lenth, it's also sentence-based ("correct horse battery staple") then it would be quite easy to guess even with worse accuracy.)

potential solution: keep a few intentional typos in your passphrases. It also makes dictionary attacks much harder.

now you have to remember the the typos

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#213
post #39

Earlier quoted context omitted.

Or just use 2fa

If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is ba…

which is the point of 2fa – when the 1st factor fails the 2nd holds

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#214
post #206

Earlier quoted context omitted.

but mai tais on beach don't get you money, and if you are going to type on something, its better to make sure its comfortable for you.

But inconfortable for others. Surely you all know it bothers a good amount at least some of your colleagues, right?

Well, not everybody works in an open plan, a shared office, or in an office building.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#215
I wonder would it be possible / how much data would you need if you'd only have long recording but no clear text to combine it with. Maybe you'd hear space bar as it often has a distinct sound (maybe backspace and return as well), and could create a script that finds the key associated with the sound by brute forcing every key to every unique sound and trying which combinations come out as reasonable sentences.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#216

Earlier quoted context omitted.

How come keyboard sound suppression is not a standard option in all online communication apps? It’s not that hard, keyboard sounds are pretty distinct.

Maybe because it's easier said in an HN comment than in real life

VoiceMeter worked reasonably well for me after some tinkering with sliders. Nvidia RTX voice should filter that out too.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#217
post #206

Earlier quoted context omitted.

but mai tais on beach don't get you money, and if you are going to type on something, its better to make sure its comfortable for you.

But inconfortable for others. Surely you all know it bothers a good amount at least some of your colleagues, right?

[deleted]

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#218
post #181

Earlier quoted context omitted.

Seems simple to defend - use a password manager.

until you have to type your password to unlock it

High security safe locks have had protection against this for a long time: you press up/down arrows to move from a random starting digit to the correct digit.

On screen pin entry with jumbled number mappings does the same thing. It also makes the inter-stroke delay rather independent of position, because the brain has to search the screen (although repeated digits and previously occuring digits are quicker, which is why some jumble at every keystroke).

Keyboards with OLED keys (like the Apple Touchbar or the Optimus[1]) might also work.

[1] https://www.artlebedev.com/optimus/popularis/

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#219
post #182

Earlier quoted context omitted.

I used to work in an office space with an independent contractor whose schtick was that he was a genius. The affectations around his genius-ness included casually bringing up Mensa meetings, dropping magazines like Foreign Affairs and academic journals around the office, and his fucking keyboard. The keyboard had custom switches that were very loud. And he typed fast - it was like living on a gun range. Everyone in t…

Somewhat tangential: clicky switches, like Cherry Blues, tend to click twice for each stroke. I think this leads to people assuming there are twice as many strokes going on. Tactile switches tend to only click once (when they bottom out). So, fancy keyboards can make people sound faster than they are.

I don't think that's quite right. Many switches including tactiles will make a sound when the switch tops out, from the stem hitting the housing.

As far as I know, Cherry blues only click once and the second sound you hear on a keypress is just the topping out sound.

https://cdn-blog.adafruit.com/uploads/2016/09/Blue.gif

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#220

By the way, some (most?) videoconferencing software removes keyboard sounds from the audio, because it's particularly a distracting problem with laptops where the microphone is right next to the keys. I'm pretty sure Zoom does this by default as part of its noise cancellation (it's potentially even easier since you can use keydown events to help identify, not just the audio stream). So as long as basic default noise…

Teams definitely don't have this, at least not by default, or not by default in our corp. Anytime somebody on the call starts typing you hear it very clearly.
Post reply on HN