Earlier quoted context omitted.
Never use public wifi. I don't.
That is a large cost to pay.
It isn't really. Mobile data is a must from a security point of view. Combine it with a VPN and you have your out and about internet access sorted.
Inferring Your Mobile Phone Password via WiFi Signals
31–40 of 69 posts
Re: Inferring Your Mobile Phone Password via WiFi Signals
#32Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
The defence is definitely to not use public wifi. This technology works because they can identify small target windows (e.g. you just accessed a URL to login to your bank account) in which to make and process these measurements. Any kind of abnormal obfuscation of your device should introduce enough noise to prevent this attack from generating any meaningful data from the victim, but I'm running on assumption.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#33Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
Never use public wifi. I don't.
As far as I understood, this attack vector has nothing to do with using public wifi.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#34Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
Or scramble the numeric keypad on every try, but that would get annoying fast.
My bank did that with a JavaScript number pad. They went back to a standard password field with the new design of the site a couple of years ago. That made me feel less safe because I understood why the were complicating the input.
Another strategy I've seen is to ask some random digits of a longer PIN, with a mask to fill out.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#35Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
Or scramble the numeric keypad on every try, but that would get annoying fast.
Convenient option on Cyanogenmod. Been using it for about 2 years and it's surprisingly easy to get used-to.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#36Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
I think this is pretty hand-wavey and requires a lot assumptions to be true.
Also: "We collected training and testing data from 10 volunteers." Not a statistically useful sample set.
Under very controlled environments, measuring signal deltas may be possible- but I would like to see sample data that suggests high success rates before I think this is worthy of concern.
Finally- Self tuning antennas are a thing. This is going to get harder over time. https://www.qualcomm.com/videos/qualcomm-rf360-dynamic-anten...
Re: Inferring Your Mobile Phone Password via WiFi Signals
#37Earlier quoted context omitted.
That is a large cost to pay.
It isn't really. Mobile data is a must from a security point of view. Combine it with a VPN and you have your out and about internet access sorted.
Mobile data is often slow or unavailable depending on what room of a building you're in etc. outside of cities.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#38Read the section "limitations". Only works on 10 users right now, must be trained for the pattern "per user", phone must be sitting on stable surface, gesture must be performed as close to "the same" every time. This is just clickbait and "please fund our research" IMO.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#39Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?
Or scramble the numeric keypad on every try, but that would get annoying fast.
Anybody who plays Runescape will recognize this. They have a pin you can set to gain access to your in game bank. It has a fair few security features to combat keyloggers which were (and still can be) a major issue.
Some security features I can recall.
Random layout of the numbers on both the button itself and which button has which number. This is shuffled on every click.
Upon clicking all numbers and the mouse pointer vanish. This prevents screenshots taken on clicks by some keyloggers from working.
No keyboard input. Annoying but needed to combat keyloggers.
http://vignette2.wikia.nocookie.net/2007scape/images/c/c3/Ba...
Re: Inferring Your Mobile Phone Password via WiFi Signals
#40Earlier quoted context omitted.
Never use public wifi. I don't.
As far as I understood, this attack vector has nothing to do with using public wifi.
The attack presented in this paper relies on the user connecting to the wifi hotspot. This is necessary so that they can figure when a sensitive operation is happening.
Without this information, it is difficult to determine if the user is inputting a password. In addition, if we know the user is using the bank of america app, and we know that the app uses a specific key lay out, it becomes a lot easier to figure out what keys they are pressing.
There is no reason that the other technique they discussed, which does not require the target to connect to a specific wifi hotspot, could not be improved though.