Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-driven thermal cameras used to obtain passwords

gla.ac.uk

Post reply on HN
Print view View original

51–60 of 88 posts

Re: AI-driven thermal cameras used to obtain passwords

#51

Post by somehnacct3757 »

4gotunameagain wrote: post #46
somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

what's easier, doing an elaborate dance every single time you touch an ATM, or cancelling your card and having the bank revert the transactions in the relatively slim chance of fraud ? :)

Depends on the situation. If you're traveling, cancelling your card while away from home is a huge setback.

Re: AI-driven thermal cameras used to obtain passwords

#52

Post by pfarrell »

somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

Thinking about this for an ATM. How about entering your password and then pushing every other key. That would leave approximately the same heat signature in every key. Maybe.

Re: AI-driven thermal cameras used to obtain passwords

#53

Post by rexreed »

SketchySeaBeast wrote: post #40
rexreed wrote: post #32

Long passwords with repeated characters are the easiest defeat on this "attack". A simple camera that records the actual keypresses is a much more sensical attack. After all, if you can present a thermal camera to the keypad, you can present an actual camera. Why use heat residue to "guess" keypresses with an 80-ish% accuracy rate at best, when you can record the actual keypresses, in the right order, including repea…

Now we need a palindromic equivalent to "correct horse battery staple".

Well if you mean Anagram, here's one that works: "CYBERATHLETES REPORT ACTORS"

Re: AI-driven thermal cameras used to obtain passwords

#54

Post by omwow »

pfarrell wrote: post #52
somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

Thinking about this for an ATM. How about entering your password and then pushing every other key. That would leave approximately the same heat signature in every key. Maybe.

That's what I do.

Re: AI-driven thermal cameras used to obtain passwords

#55

Post by _visgean »

somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

Hmm I have recently started using google pay at ATMs, with virtual card numbers - https://support.google.com/googlepay/answer/11234179?hl=en&c... I think it should be impossible to to skim that.

Re: AI-driven thermal cameras used to obtain passwords

#56

Post by layer8 »

teddyh wrote: post #42
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

How do you authenticate the password manager?

The context was to stop entering passwords into web sites . The password manager is run locally.

Passwords for websites are (hopefully) hashed locally. And more importantly, how does it make a difference whether you or the password manager types in the password into the web form?

Re: AI-driven thermal cameras used to obtain passwords

#57

Post by Ancapistani »

somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

> My list of ATM defensive rituals grows even longer.

As does my list of potential sources for free thermal cameras.

That said - I’ve yet to find a skimmer, even though I check for them every time I use a terminal.

Re: AI-driven thermal cameras used to obtain passwords

#58

Post by layer8 »

SketchySeaBeast wrote: post #40
rexreed wrote: post #32

Long passwords with repeated characters are the easiest defeat on this "attack". A simple camera that records the actual keypresses is a much more sensical attack. After all, if you can present a thermal camera to the keypad, you can present an actual camera. Why use heat residue to "guess" keypresses with an 80-ish% accuracy rate at best, when you can record the actual keypresses, in the right order, including repea…

Now we need a palindromic equivalent to "correct horse battery staple".

It already has four Rs, four Es, four Ts, and two As and Os. I think it’s fine.

Re: AI-driven thermal cameras used to obtain passwords

#59

Post by Wowfunhappy »

layer8 wrote: post #56
teddyh wrote: post #42

Earlier quoted context omitted.

The context was to stop entering passwords into web sites . The password manager is run locally.

Passwords for websites are (hopefully) hashed locally. And more importantly, how does it make a difference whether you or the password manager types in the password into the web form?

> And how does it make a difference whether you or the password manager types in the password into the web form?

Well, because a hidden camera can observe a human typing their password, whereas a password manager does not need to press any physical keys.

However, a camera can observe a human typing a master password into their password manager, which is where I was originally going with the question.

Re: AI-driven thermal cameras used to obtain passwords

#60

Post by SketchySeaBeast »

rexreed wrote: post #53
SketchySeaBeast wrote: post #40

Earlier quoted context omitted.

Now we need a palindromic equivalent to "correct horse battery staple".

Well if you mean Anagram, here's one that works: "CYBERATHLETES REPORT ACTORS"

No, I meant palindrome, so that you end up repeating the same letters with little increase in memorization complexity, but that works too - throw together a few anagrams and you're golden.
Post reply on HN