Fortunately most people stay at the machine after typing their password. Anyway perhaps now is a good time to get some 2fa hardware token.
Even with 2FA, any sort of "remember me for a minute and I'll go get a coffee" makes it pretty useless.
AI-driven thermal cameras used to obtain passwords
21–30 of 88 posts
Re: AI-driven thermal cameras used to obtain passwords
#22This is just silly: how many people punch in their PIN number and then leave immediately? I guess these researchers haven't ever withdrawn money from an ATM.
From TFA:
> 86% of passwords when thermal images are taken within 20 seconds, and 76% when within 30 seconds
Re: AI-driven thermal cameras used to obtain passwords
#23I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.
There would still be a temperature difference for some time after entering a PIN until the keys used are fully cooled. So this method might not fully mitigate the attack.
A better solution could be to heat the keys to about the same temperature as a human's finger tips, so that no heat is being transferred while entering a PIN.
Re: AI-driven thermal cameras used to obtain passwords
#24Earlier quoted context omitted.
So in case of ATMs we now need to make sure we soft touch some random buttons to ensure this trick doesn't work.
I have already seen some ATMs that shuffle the numbers on the numberpad around for each PIN entry. It is inconvenient for muscle memory, but prevents this kind of attack.
I know somebody working at a bank talking about their implementation, and how many elderly customers block their cards after wrongly entering their pin.
Re: AI-driven thermal cameras used to obtain passwords
#25I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.
I had seen a video demoing an attack like this some while ago and I started "wiping" keypads with my fingers so they're all "warm"
Re: AI-driven thermal cameras used to obtain passwords
#26It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript, currently every website has to implement their own login protocol in JavaScript.
https://www.cloudflare.com/learning/access-management/what-i... https://github.com/w3c/webauthn/issues/1255 https://github.com/w3c/webauthn/issues/1616
Re: AI-driven thermal cameras used to obtain passwords
#27It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…
[deleted]
Re: AI-driven thermal cameras used to obtain passwords
#28It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…
We should stop manually entered passwords. Using a password manager (like the one built into your web browser) with unique secure passwords is fine.
Re: AI-driven thermal cameras used to obtain passwords
#29Someone's been playing Splinter Cell!
Or watched the first episode of Max Headroom (from 1987).
Re: AI-driven thermal cameras used to obtain passwords
#30My list of ATM defensive rituals grows even longer.
For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements.
Cover the keypad with your other hand, take detours when moving your hand, and, now, pretend press a handful of random keys.
I will try inserting bogus numbers into my PIN ritual and pretend pressing them as part of entry. Should protect against hand movements and thermal imaging as well.