Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-driven thermal cameras used to obtain passwords

gla.ac.uk

Post reply on HN
Print view View original

31–40 of 88 posts

Re: AI-driven thermal cameras used to obtain passwords

#31

Post by jaclaz »

LaputanMachine wrote: post #23
gluecode wrote: post #11

I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.

There would still be a temperature difference for some time after entering a PIN until the keys used are fully cooled. So this method might not fully mitigate the attack. A better solution could be to heat the keys to about the same temperature as a human's finger tips, so that no heat is being transferred while entering a PIN.

Exactly, easier and much more effective than the mitigation suggested by the scientists:

>One potential risk-reduction pathway could be to make it illegal to sell thermal cameras without some kind of enhanced security included in their software.

Re: AI-driven thermal cameras used to obtain passwords

#32

Post by rexreed »

Long passwords with repeated characters are the easiest defeat on this "attack". A simple camera that records the actual keypresses is a much more sensical attack. After all, if you can present a thermal camera to the keypad, you can present an actual camera. Why use heat residue to "guess" keypresses with an 80-ish% accuracy rate at best, when you can record the actual keypresses, in the right order, including repeated characters with a much higher accuracy rate? The only possible use for this "attack" is for analyzing residual heat with a handheld thermal camera after the person is gone, but as mentioned, long passwords with repeated keypresses is the defeat as is simply holding your hand on the keyboard after the password is entered. If you can protect against a visual camera then that's more important.

Re: AI-driven thermal cameras used to obtain passwords

#33

Post by wongarsu »

pabs3 wrote: post #26

It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…

That's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.

Re: AI-driven thermal cameras used to obtain passwords

#35

Post by SanjayMehta »

wongarsu wrote: post #14
SanjayMehta wrote: post #6

This is just silly: how many people punch in their PIN number and then leave immediately? I guess these researchers haven't ever withdrawn money from an ATM.

That's how pin pads on doors work: you punch in the PIN, then immediately go through the door. And those pin pads are somewhat popular in commercial settings because it's easier to distribute knowledge than to distribute physical keys.

I haven't seen a PIN pad lock in years in secure facilities, everyone uses contactless cards.

Re: AI-driven thermal cameras used to obtain passwords

#36

Post by Semaphor »

cricalix wrote: post #10
amelius wrote: post #2

Fortunately most people stay at the machine after typing their password. Anyway perhaps now is a good time to get some 2fa hardware token.

There are ATMs in Europe that will take the card, ask for what you want to do, ask the amount if it’s a withdrawal, and then ask for the PIN and dispense it. This reduces the time between typing and dispensing. No idea if it’s a significant enough reduction in the time versus card, pin, navigate to withdraw, dispense such that it would enable this attack.

What do ATMs elsewhere do? This is the only way I know.

Re: AI-driven thermal cameras used to obtain passwords

#37

Post by SanjayMehta »

eequah9L wrote: post #22
SanjayMehta wrote: post #6

This is just silly: how many people punch in their PIN number and then leave immediately? I guess these researchers haven't ever withdrawn money from an ATM.

From TFA: > 86% of passwords when thermal images are taken within 20 seconds, and 76% when within 30 seconds I don't know how long you spend at the ATM, myself I suspect I would typically fit within the 20 second window.

Well, then all they'd get from me is 5000 - that's the amount what I punch in after the PIN for my typical cash withdrawal.

Re: AI-driven thermal cameras used to obtain passwords

#38

Post by Wowfunhappy »

teddyh wrote: post #28
pabs3 wrote: post #26

It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…

We should stop manually entered passwords. Using a password manager (like the one built into your web browser) with unique secure passwords is fine.

How do you authenticate the password manager?

Re: AI-driven thermal cameras used to obtain passwords

#39

Post by SketchySeaBeast »

Wowfunhappy wrote: post #38
teddyh wrote: post #28

Earlier quoted context omitted.

We should stop manually entered passwords. Using a password manager (like the one built into your web browser) with unique secure passwords is fine.

How do you authenticate the password manager?

With Keepass you can use a yubikey or key file.

Re: AI-driven thermal cameras used to obtain passwords

#40

Post by SketchySeaBeast »

rexreed wrote: post #32

Long passwords with repeated characters are the easiest defeat on this "attack". A simple camera that records the actual keypresses is a much more sensical attack. After all, if you can present a thermal camera to the keypad, you can present an actual camera. Why use heat residue to "guess" keypresses with an 80-ish% accuracy rate at best, when you can record the actual keypresses, in the right order, including repea…

Now we need a palindromic equivalent to "correct horse battery staple".
Post reply on HN