Scary AI recognizes passwords by the sound of your typing
1–10 of 28 posts
Re: Scary AI recognizes passwords by the sound of your typing
#2Don’t type passwords. Use 2FA whenever possible
Re: Scary AI recognizes passwords by the sound of your typing
#3Does anyone know what the SotA foss local demo of something like this is? I'd really like to try and understand first hand what the limitations are.
Re: Scary AI recognizes passwords by the sound of your typing
#4Don’t type passwords. Use 2FA whenever possible
No thanks, I'd rather keep my secrets unbound from any physical object.
Re: Scary AI recognizes passwords by the sound of your typing
#5Don’t type passwords. Use 2FA whenever possible
Do both.
Biometric to unlock phone, PIN to load 2FA auth app, and a password to actually login.
Actually, I am reminded of the 00s when companies used to have badges and badge readers you'd take home and plugin to your machine and you had to use those to authenticate connections.
Password + physical token. It was secure, but not convenient if you left your badge behind somewhere.
It wasn't wireless, no worries about snooping.
When it did work, it was magic. My Active Directory credentials automatically carried over between machines, across networks, for debugging purposes to dev boxes, and I was even able to step from C# code running locally into a stored procedures on a remove SQL server all from within (the OG) Visual Studio.
Nothing works anything near that well anymore. :(
(Show of hands, who here reading this can start debugging their staging environment databases from within their IDE, with a single button press?)
Re: Scary AI recognizes passwords by the sound of your typing
#6Don’t type passwords. Use 2FA whenever possible
No thanks, I'd rather keep my secrets unbound from any physical object.
Your password can still be a secret unbound from any physical object. This is just a second layer, so I don't really see the downside
EDIT: I guess you're right in that the parent was suggesting NOT typing passwords and sort of equating that to 2FA. so yeah, I like to keep one password in my head only (for sensitive stuff) and use a second factor if possible
Re: Scary AI recognizes passwords by the sound of your typing
#7I read about this in the Silence on the Wire by Michal Zalewski. And you don't need a fullblown AI, a good statistical model is enough to make a guess on passwords, and if you have a bunch of probabilities to cut down your search space to a more probable set. And the book is from 2005, so I wouldn't say it is new. https://nostarch.com/silence.htm
I even remember reading about how Clifford Stoll recognized the different attackers by "typing rhythm" in Cuckoo's Egg.
Re: Scary AI recognizes passwords by the sound of your typing
#8No details about what specific study they are referring to. These attacks are possible for several years now.
2016 - "Don't Skype & Type! Acoustic Eavesdropping in Voice-Over-IP" - https://arxiv.org/abs/1609.09359
2020 - "Behavioral Acoustic Emanations: Attack and Verification of PIN Entry Using Keypress Sounds" - https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7309150/
Maybe they mean this one...
2023 - "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards" - https://arxiv.org/abs/2308.01074
Re: Scary AI recognizes passwords by the sound of your typing
#9I read about this in the Silence on the Wire by Michal Zalewski. And you don't need a fullblown AI, a good statistical model is enough to make a guess on passwords, and if you have a bunch of probabilities to cut down your search space to a more probable set. And the book is from 2005, so I wouldn't say it is new. https://nostarch.com/silence.htm I even remember reading about how Clifford Stoll recognized the differe…
“fist recognition” is at least as old as morse code.
Re: Scary AI recognizes passwords by the sound of your typing
#10Don’t type passwords. Use 2FA whenever possible
No thanks, I'd rather keep my secrets unbound from any physical object.
My 2FA OTPs are synced by 1Password which I can access from any of my devices; you can set up something similar with FOSS if you want full control. Authenticating to 1Password requires both a master password and a secret key; they have a feature called "Emergency Kit" for creating offline backups of the key (https://support.1password.com/emergency-kit/)