Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards • Hacker News Board

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#91

Post by angry_octet » Wed, Jul 11, 2018, 9:06 PM UTC

Makes me wonder if you could achieve a similar effect by spraying some residue over the keypad before the victim uses it, then looking at it after PIN entry. For example, a fluorescing dust. As well a special fingerprinting powders (e.g. https://optimumtechnology.com.au/latent-fingerprint-powders/) you can get stuff from art supplies stores: https://www.glowpaint.com.au/blue-uv-black-light-powder/ .

There is also thermochromic ink, e.g. a grey ink that changes to colourless at 15C. http://www.smarol.com/Ultraviolet-Fluorescent-Powder.html

At this point, I don't think it is viable to pretend that long lifetime secrets, like your bank PIN, are safe if entered into hundreds of different keypads in insecure settings.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#92

Post by leni536 » Thu, Jul 12, 2018, 11:27 AM UTC

angry_octet wrote: post #90

leni536 wrote: post #56

Earlier quoted context omitted.

Allowing adjacent codes and accepting the same code twice is not the same. I would be surprised if TOTP allowed for accepting the same code twice.

Typically this is allowed. Probably because otherwise the server would have to store and compare state, but also because otherwise the user could be locked out for 60s.

> but also because otherwise the user could be locked out for 60s.

I don't see this. Note that it's not about rate limiting unsuccessful attempts (which obviously should be done to some extent) but not allowing the valid OTP to be used twice. In the worst case once the user logged in he can't login from an other device for 60s. Not a huge limitation. Also AFAIK 30s rotation of the OTP is more common/standard.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#93

Post by stretchwithme » Fri, Jul 13, 2018, 7:23 AM UTC

deno wrote: post #31

stretchwithme wrote: post #27

Probably a good idea to repeat at least one character.

Depends on what the password is for. If it can be brute forced offline then you’ll need a lot more than one character to make any difference.

I think you missed my point. If you use a key more than once, heat can't be used to figure out the first time that key was pressed. Only the second press of it can be deduced.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#94

Post by deno » Fri, Jul 13, 2018, 9:34 AM UTC

stretchwithme wrote: post #93

deno wrote: post #31

Earlier quoted context omitted.

Depends on what the password is for. If it can be brute forced offline then you’ll need a lot more than one character to make any difference.

I think you missed my point. If you use a key more than once, heat can't be used to figure out the first time that key was pressed. Only the second press of it can be deduced.

Sure but you reduce the search space considerably anyway.