August Dvorak was more prescient than we ever gave him credit for!
AI-driven thermal cameras used to obtain passwords
71–80 of 88 posts
Re: AI-driven thermal cameras used to obtain passwords
#72This isn't news to me at all. For ATM/Pin pads, I wipe my fingers across every button as I press in the code, so it obscures what was actually pressed, and linger fingers on keys not even in my pin code. With enough practice, it doesn't take more than a second or two longer than normally entering it. As far as keyboards, I really don't ever interact with computers that don't belong to me or aren't in a secure area, b…
Indeed, this is not a new idea. The news here is about particular implementation for extracting passwords from QWERTY keyboards.
That said, this is not a big problem for ATM pin pads with metal keys, because these conduct heat well and so a heat pattern is hard to detect after few seconds. See: https://www.youtube.com/watch?v=PJCfTlQ82Fw
Re: AI-driven thermal cameras used to obtain passwords
#73Earlier quoted context omitted.
No, I meant palindrome, so that you end up repeating the same letters with little increase in memorization complexity, but that works too - throw together a few anagrams and you're golden.
My favorite palindrome is "A man, a plan, a canal, Panama". Supposedly a reference to former US president Theodore Roosevelt and his quest for the Panama canal.
"Put Eliot's toilet up" has stuck with me for years. As has 'I know a fat man called Ella C Namtafawonki'.
Re: AI-driven thermal cameras used to obtain passwords
#74My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…
> My list of ATM defensive rituals grows even longer. As does my list of potential sources for free thermal cameras. That said - I’ve yet to find a skimmer, even though I check for them every time I use a terminal.
This is the best idea yet. The best defense is a good offense.
Re: AI-driven thermal cameras used to obtain passwords
#75Earlier quoted context omitted.
Exactly, easier and much more effective than the mitigation suggested by the scientists: >One potential risk-reduction pathway could be to make it illegal to sell thermal cameras without some kind of enhanced security included in their software.
I'm curious what kind of software solution there could be to this? Some from of pattern matcher in the camera obscuring the video output when it determines its observing a number pad?
Maybe something loosely similar to the protection that is said to be present in very high level colour photocopier that prevents from photocopying money?
Re: AI-driven thermal cameras used to obtain passwords
#76This was a way to get through a level in Tom Clancy's Splinter Cell (the original game) 20 years ago.
Re: AI-driven thermal cameras used to obtain passwords
#77My bank ATM randomly sends a One-time-passcode to my mobile phone and challenges me to enter that on the ATM pinpad (in addition to my ATM pin). This is especially true when I try to withdraw from an ATM that is not my usual location (or I guess is an ATM at a location that is internally flagged for high number of ATM fraud incidents).
Re: AI-driven thermal cameras used to obtain passwords
#78Someone's been playing Splinter Cell!
Or watched the first episode of Max Headroom (from 1987).
Really? Was fairly sure Splinter Cell really didn't invent this, but it was what came to mind. Didn't know it went back that far. I'll have to look that up, I only know Max Headroom from clips.
Re: AI-driven thermal cameras used to obtain passwords
#79My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…
Thinking about this for an ATM. How about entering your password and then pushing every other key. That would leave approximately the same heat signature in every key. Maybe.
Or pushing keys with a stylus, a pencil with the eraser side, or some other object that won't leave a thermal print?
Re: AI-driven thermal cameras used to obtain passwords
#80Earlier quoted context omitted.
> Carry the dongle everywhere? If so, you risk losing the dongle. To be fair, we also carry our IDs everywhere and risk losing them all the time, yet it works pretty fine in most cases. Losing your ID is painful, and so would be losing the dongle, but the security of it outweighs the risk, IMHO. Even more if we create dongles that are shaped like cards, so we can keep them in our wallets like IDs.
Normally you do not use the ID in day to day operations. A better example would be a credit card, which combines a password (or pin) with a cryptographic chip. The card itself is too easy to steal, hence the backup password. The other possibility is biometrics, but these come with their own problems.
It sounds like you don't live in the USA. No passwords here.