Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-driven thermal cameras used to obtain passwords

gla.ac.uk

Post reply on HN
Print view View original

61–70 of 88 posts

Re: AI-driven thermal cameras used to obtain passwords

#61

Post by DigitallyFidget »

This isn't news to me at all. For ATM/Pin pads, I wipe my fingers across every button as I press in the code, so it obscures what was actually pressed, and linger fingers on keys not even in my pin code. With enough practice, it doesn't take more than a second or two longer than normally entering it.

As far as keyboards, I really don't ever interact with computers that don't belong to me or aren't in a secure area, but I have a custom scripted "keyboard" USB circuit thing that emulates keypresses for me. I don't know what to even call it, but it's like a mini Arduino sorta thing that emulates a generic Microsoft keyboard to whatever you plug it into. It looks like a stick of RAM with a USB plug, kinda. I have a few preset buttons that'll type in my login info to automate logging into things. I made it as a hardware password manager.

Re: AI-driven thermal cameras used to obtain passwords

#62

Post by bheadmaster »

alistairSH wrote: post #50
bheadmaster wrote: post #44

Earlier quoted context omitted.

I don't think "things I own" is a bad security model in itself. The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.

Using your dongle example, how do you access important services away from home? Carry the dongle everywhere? If so, you risk losing the dongle. Same with your phone as the "thing I own". That's great, until the phone dies/breaks/gets lost. Hopefully you have a tablet as backup, or the paper copy of your one-time codes in your wallet. I don't have a good answer. I just hate the idea of needing to access banking servic…

> Carry the dongle everywhere? If so, you risk losing the dongle.

To be fair, we also carry our IDs everywhere and risk losing them all the time, yet it works pretty fine in most cases. Losing your ID is painful, and so would be losing the dongle, but the security of it outweighs the risk, IMHO.

Even more if we create dongles that are shaped like cards, so we can keep them in our wallets like IDs.

Re: AI-driven thermal cameras used to obtain passwords

#63

Post by layer8 »

Wowfunhappy wrote: post #59
layer8 wrote: post #56

Earlier quoted context omitted.

Passwords for websites are (hopefully) hashed locally. And more importantly, how does it make a difference whether you or the password manager types in the password into the web form?

> And how does it make a difference whether you or the password manager types in the password into the web form? Well, because a hidden camera can observe a human typing their password, whereas a password manager does not need to press any physical keys. However, a camera can observe a human typing a master password into their password manager, which is where I was originally going with the question.

I meant regarding local vs. nonlocal, what the GP objected to.

Re: AI-driven thermal cameras used to obtain passwords

#64

Post by Arrath »

jaclaz wrote: post #31
LaputanMachine wrote: post #23

Earlier quoted context omitted.

There would still be a temperature difference for some time after entering a PIN until the keys used are fully cooled. So this method might not fully mitigate the attack. A better solution could be to heat the keys to about the same temperature as a human's finger tips, so that no heat is being transferred while entering a PIN.

Exactly, easier and much more effective than the mitigation suggested by the scientists: >One potential risk-reduction pathway could be to make it illegal to sell thermal cameras without some kind of enhanced security included in their software.

I'm curious what kind of software solution there could be to this?

Some from of pattern matcher in the camera obscuring the video output when it determines its observing a number pad?

Re: AI-driven thermal cameras used to obtain passwords

#65

Post by AstralStorm »

brk wrote: post #49

They appear to be using a somewhat costly handheld thermal camera, which likely has a FLIR Boson or equivalent sensor. Those are pretty bulky and expensive, making it hard to use this attack without hanging out near the keyboard/keypad you want to surveil. A FLIR Lepton series[0], or similar, is much smaller, but still ~$160/ea., and even though it is "smaller", it's not as easy to hide in an ATM as a cheap pinhole c…

Yes, you're much more likely to have a regular camera installed on the ATM or keypad. Night vision makes it work at all times. Or you can instrument a keypad with a laser sensor overlay.

The IR camera is used to defeat obscured keypads only...

Re: AI-driven thermal cameras used to obtain passwords

#66

Post by AstralStorm »

bheadmaster wrote: post #62
alistairSH wrote: post #50

Earlier quoted context omitted.

Using your dongle example, how do you access important services away from home? Carry the dongle everywhere? If so, you risk losing the dongle. Same with your phone as the "thing I own". That's great, until the phone dies/breaks/gets lost. Hopefully you have a tablet as backup, or the paper copy of your one-time codes in your wallet. I don't have a good answer. I just hate the idea of needing to access banking servic…

> Carry the dongle everywhere? If so, you risk losing the dongle. To be fair, we also carry our IDs everywhere and risk losing them all the time, yet it works pretty fine in most cases. Losing your ID is painful, and so would be losing the dongle, but the security of it outweighs the risk, IMHO. Even more if we create dongles that are shaped like cards, so we can keep them in our wallets like IDs.

Normally you do not use the ID in day to day operations. A better example would be a credit card, which combines a password (or pin) with a cryptographic chip.

The card itself is too easy to steal, hence the backup password. The other possibility is biometrics, but these come with their own problems.

Re: AI-driven thermal cameras used to obtain passwords

#68

Post by woeh »

DigitallyFidget wrote: post #61

This isn't news to me at all. For ATM/Pin pads, I wipe my fingers across every button as I press in the code, so it obscures what was actually pressed, and linger fingers on keys not even in my pin code. With enough practice, it doesn't take more than a second or two longer than normally entering it. As far as keyboards, I really don't ever interact with computers that don't belong to me or aren't in a secure area, b…

I've been in a hotel where the rooms had pin pads as locks that required you to press two random numbers every time you want to enter. The pad was a bit sensitive to fingerprints, but due to this mechanism there would be fingerprints all over the device.

Re: AI-driven thermal cameras used to obtain passwords

#69

Post by rexreed »

SketchySeaBeast wrote: post #60
rexreed wrote: post #53

Earlier quoted context omitted.

Well if you mean Anagram, here's one that works: "CYBERATHLETES REPORT ACTORS"

No, I meant palindrome, so that you end up repeating the same letters with little increase in memorization complexity, but that works too - throw together a few anagrams and you're golden.

My favorite palindrome is "A man, a plan, a canal, Panama". Supposedly a reference to former US president Theodore Roosevelt and his quest for the Panama canal.

Re: AI-driven thermal cameras used to obtain passwords

#70

Post by MichaelMcG »

somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

Sorry, but which video are you referring? Can't find it in the article, I'm assuming you were replying to a different comment.
Post reply on HN