Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inferring Your Mobile Phone Password via WiFi Signals

fermatslibrary.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Inferring Your Mobile Phone Password via WiFi Signals

#21

Post by [deleted] »

sounds wrote: post #9
swsieber wrote: post #8

Earlier quoted context omitted.

It would seem that that's not the moral of the story: it looks like your device doesn't even have to connect to the wifi. It appears that this is more like using wifi as radar to detect finger movements.

Yes, I think a passive listener in promiscuous mode would work. And more listeners located around the room would be even better, if their signals could be very precisely correlated in time. In more detail: CSI is available to the _receiver_ of the wifi packet. In other words: • Your phone can determine CSI for all AP broadcasts. (Useful for indoor positioning) • The AP can determine CSI for any packet sent to it. Thu…

[deleted]

Re: Inferring Your Mobile Phone Password via WiFi Signals

#23

Post by djrogers »

xenithorb wrote: post #10
swsieber wrote: post #8

Earlier quoted context omitted.

It would seem that that's not the moral of the story: it looks like your device doesn't even have to connect to the wifi. It appears that this is more like using wifi as radar to detect finger movements.

So then its probably a pretty good idea to randomize the number keypad for the lock screen, which I do. Does this defeat that, I can't think of a way it does..

The paper focused on an attack against a payment system, not the lock screen, so you'd need to randomize every password input keyboard at the system level.

Probably not a bad idea...

Re: Inferring Your Mobile Phone Password via WiFi Signals

#24

Post by djrogers »

gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

> Have your phone manage the passwords and unlock via fingerprint?

Yes, that would defeat this particular attack.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#25

Post by frandroid »

gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

Or scramble the numeric keypad on every try, but that would get annoying fast.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#26

Post by danbruc »

andai wrote: post #14

See also: detecting and motion tracking people behind walls, with the ability to recognise specific people ( also using wifi ). http://www.theverge.com/2015/10/28/9625636/rf-capture-mit-wi... Of particular interest: It can determine breathing patterns and heart rate.

Or the 2013 discussion of Wi-Fi signals enable gesture recognition throughout entire home here on Hacker News with links to other related ideas in the comments.

[1] https://news.ycombinator.com/item?id=5824286

Re: Inferring Your Mobile Phone Password via WiFi Signals

#27

Post by mratzloff »

gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

Never use public wifi. I don't.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#28

Post by adevine »

frandroid wrote: post #25
gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

Or scramble the numeric keypad on every try, but that would get annoying fast.

I've seen some secure financial sites that already do that.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#29

Post by cortesoft »

mratzloff wrote: post #27
gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

Never use public wifi. I don't.

That is a large cost to pay.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#30

Post by danielhooper »

andai wrote: post #15
danielhooper wrote: post #3

Some weeks back I read a post here about detecting people in rooms by measuring how the physical body interferes with the wifi signals. I wouldn't have imagined someone could extract useful information at this small of a scale. wow!

This one! http://www.theverge.com/2015/10/28/9625636/rf-capture-mit-wi... It can detect people and track their movements behind walls , and tell different people apart. It can also measure breathing patterns and heart rate.

I clearly did not read into this enough as it is more impressive than I had remembered. It's quite the eye-opener on how much unique data there is out in the wild...
Post reply on HN