I wonder how well this would go paired with that attack from a year or so ago that can recover audio from video of a glass window pane. Set up a camera pointed at the outside of your competitor's office? Hear their passwords? heck even send them an email, recieve a reply, and train on them typing emails sent to you?
New acoustic attack steals data from keystrokes with 95% accuracy
231–239 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#232So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
Yeah and in fact, I've heard of this attack being done in the past, but it heavily depends on the typist, the keyboard, etc. Cadence, sound, etc changes with the typist and hardware. This isn't new, and has very few, if any practical applications for wide spread replication.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#233Earlier quoted context omitted.
Somewhat tangential: clicky switches, like Cherry Blues, tend to click twice for each stroke. I think this leads to people assuming there are twice as many strokes going on. Tactile switches tend to only click once (when they bottom out). So, fancy keyboards can make people sound faster than they are.
I don't think that's quite right. Many switches including tactiles will make a sound when the switch tops out, from the stem hitting the housing. As far as I know, Cherry blues only click once and the second sound you hear on a keypress is just the topping out sound. https://cdn-blog.adafruit.com/uploads/2016/09/Blue.gif
And they make little o rings to dampen that if you're hardcore.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#234Earlier quoted context omitted.
I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
I fear that "in the name of security" is going to ruin everything.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#235Earlier quoted context omitted.
but mai tais on beach don't get you money, and if you are going to type on something, its better to make sure its comfortable for you.
But isn't one of the reasons for using mechanical switches to be able to not bottom out, hence avoiding the repetitive shocks on the fingers? This is what I do with my tactile keyboards, and I'm actually quieter when I type quickly than my colleagues who bottom out on their cheap hollow HP keyboards like no tomorrow.
Is it? I've had a few mechanical keyboards, and follow some of those webpages devoted to different switches etc (not obsessively though, once in a blue moon), and I don't recall seeing "bottoming out" and "shocks" as any major benefit mentioned.
I also remember typewriters and old IBM style mechanical keyboards beeing quite heavy to activate, subjectively needing more pressure than some chiclet style "shock" (which I can barely feel).
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#236So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
it is definitely possible to generalise this, a couple of years ago I did the same with a pair of microphones.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#237Earlier quoted context omitted.
but mai tais on beach don't get you money, and if you are going to type on something, its better to make sure its comfortable for you.
But inconfortable for others. Surely you all know it bothers a good amount at least some of your colleagues, right?
> Surely you all know it bothers a good amount at least some of your colleagues
Quiet switches for the office, clicky switches for home. Not exactly a hard problem to solve :)
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#238[dead]
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#239That would be really terrible for streamers