Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.
That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.
In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.
New policy from the corporate office: If you are working in a public place, like a coffee shop, please scream while typing your login password.
I screamed my password and now I got hacked. Thanks for nothing!
use the onscreen keyboard
much more secure
why won’t my bank stop calling me
Use a speech to text and they won’t be able to hear your keyboard strokes. I know, I’m a genius.
Who are you, who are so wise in the ways of science?
A duck.
Got any grapes?
I mean, I got lemonade…
But instead they would hear the speech and translate that to text. No need to thank me.
Quite scary considering the accuracy and how many open mics everyone is surrounded by without even realizing it. Not to mention if any content creator types their password while live streaming or recording they could get their accounts stolen.
One more reason to switch to a password manager, even though they could still find out the master password…
Probably still have some safety if you’re using two-factor, or have a master key in addition to a password (e.g. 1Password).
Or use a local password safe like keepass.
Only if you have to type it in to unlock your vault. Now, bear with me.
Bitwarden (maybe others) lets you set a PIN to unlock your vault. Normally, you would think this is a less secure setup, easier to crack with the method outlined in this article. Except with Bitwarden you have to set up the pin in every browser extension and every app install.
Meaning, unless they have access to your device, the PIN to unlock one instance of Bitwarden could be different from the PIN for another. They also don’t have to be strictly 4-digit PINs, either. I highly recommend password managers, but for my money, Bitwarden has all my love.
Disclaimer: I am on no way affiliated with Bitwarden. But I could be if they paid me!
but then I have to remember the PIN for each one of my devices. there should be some kind of app for storing those.
Do what users at most businesses do, write it on a sticky note and put it on the underside of your keyboard!
Stick around for more tech tips with a real life sysadmin!
Password manager and the LOUDEST MECHANICAL KEYBOARD POSSIBLE you have NO idea what keys I’m pressing with my blues, bitches
That’s the whole point though. The louder your keypresses the better.
laptop
laptop
laptop
I don’t think you read the article
A loud ass mech keyboard would fuck this study up
This has been a known attack vector for years, and I wonder how no livestreamer has been (publicly) attacked in this way.
I guess in large part this can be attributed to 2FA, passwords just aren’t worth much by themselves anymore (well I guess if someone is quick enough they can snipe the OTP as well, but streamers are rarely entering their 2FA while streaming since they’re on a trusted device).
In fact the biggest attack vector I’d worry about is the infamous SMS 2FA, which is actually 1FA for password resets, which is actually 0FA “yes dear phone operator I am indeed Mister Beast please move my phone number to this new SIM”.
Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.
I’ll accept the risk. I need the clicky
Good luck making an acoustic map of the tens thousands of possible case, switch and key cap combinations.
Middle management will finally get rid of clacky keyboards with this weird trick
This is why I always make sure there are no boffins around before I start typing.
If there are boffins around, I start typing out the GDPR guidelines in full
What about Hornblower’s, Bolger’s, Took’s, Sackville’s or Grubb’s?
I think I might have achieved security through obscurity. My custom keyboard is a unique shape and almost all the keys are one unit. Not only is it different enough from a traditional keyboard that the neural network probably won’t understand it, the function layers I use obscure whether I’m typing a letter at all.
Does that come with free fingerless gloves?
No, but it comes with your choice of flavoured frozen yoghurt.
That’s good!
The yogurt contains potasium benzoate
That’d bad
…
Of course not. The fingerless gloves are also niche, boutique, and premium.
I have a headache just looking at that.
What keyboard is it, corne? I have to admit that your keycaps are incredibly cursed, how you have mixed caps from different layers
It’s a chocofi.
CTGAP on the base layer, and 6 layers on top of it, using a heavily modified version of Miryoku.
Most of the keycaps are correct, just for different layers. It helps prevent key peeking, plus I like the cursed aesthetic.
that’s a surprisingly cheap keyboard. I ended up ordering a zsa voyager a couple days ago because I wanted keys, but I couldn’t find any prebuilt split keyboards that had a base configuration below like $350. I might end up going with cursed keys on mine, it looks pretty cool
I guess my typos are now a security feature!
I’d be curious how well this approach translates to multi-lingual keyboard layouts. For english users, perhaps theres another benefit to non-QWERTY layouts (e.g. Colemak or Dvorak) after all? … and two factor authentication should remain helpful I presume. Especially physical key methods with no audible characters typed (e.g. Yubikey, Titan, etc.)
Can we normalise good but quiet keyboards. Like, I like the tactile feel of using a mechanical, but I hate the sound. Quieter mechanical keyboards aren’t a thing but they should be. Now as a security measure if nothing else.
Also Dvorak keyboards I guess
There are tons of quiet mechanical keyboards. I’m using a low profile optical switch that’s quieter than my mouse clicks
Are those optical switches expensive though?
No
There are definitely quiet tactile switches. The reason why they can still make sound is because they’re bottoming out which you don’t have to do.
As a partial solution, you can put o-rings in the keycaps. I had some of the bands for braces laying around at one point and used those, and it worked fairly well.
Dvorak is a cypher of Qwerty tho. Anything typed in Dvorak but transcribed as english can be reliably identified and decyphered
normalise good but quiet keyboards
Oh man, if Topre became popular enough to bring the price down through scale that would be pretty rad
I wonder if you need to train it on a specific keyboard before it will work it.
Most likely
That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.
I also notice that I slightly change my typing style between typing normally and entering my password.
deleted by creator
I doubt so. Wouldn’t Zipf’s law be used for this?
Some laptops like the Framework laptop have fingerprint sensors
Physical Security keys like NitroKeys or YubiKeys are another option
I don’t see the relevance.
You can use fingerprint or U2F to unlock your password manager and copy the password. That way you don’t have to type it in.
That does nothing for keylogging through this method.
It would have to be combined with a secure (no microphones) area during setup, but it seems like swapped biometric plus token would defeat this attack (password gathering). It would however not defeat generic data collection.
It would eliminate someone being able to get your username or password via this method though. Because you never have to type them in.
With my MacBook I can use either touchid or my watch to automatically unlock it, so I don’t even have to type my password in to get into my laptop. And then I use touchid and Keychain for all my passwords so I never have to type those in either.
I wonder if different switches, keycap profiles, keyboard material ect affect the accuracy?
I never learned to touch-type, so my typing style is very different from most people though I can type fast enough for work.
My typing style only uses 3 fingers, and both hands type keys in the middle of the keyboard.
I wonder if this has any effect on accuracy?
Edit: Article states touch-typing can reduce accuracy. Wonder if that’s because they type more softly than us tech gorillas who tend to bash on the keys?
I’m a touch typist who can reach 160wpm when I’m really flowing, I would guess the speed makes accuracy harder to distinguish individual keys than you pressing keys with three fingers.
I could see that, makes sense.
Yeah, the article mentions that exactly - the faster you type the more the accuracy plummets.
How good does this work if there’s other noise pollution? Like music playing etc?
Is it ignorance, indemnity, or conspiracy that this News Media Corporation didn’t give the primary mitigation?
A white noise generator.
