5 ms·
Solution add a feature to warm up the screen to exactly 98 degrees to avoid detection. Learned this from sneakers.
by nkassis 10y ago
Solution add a feature to warm up the screen to exactly 98 degrees to avoid detection. Learned this from sneakers.
- oh_sigh 10y agoOr present a random 5 digit pin the user needs to enter before entering their personal pin. If the user has touched every button, then you get no information from that.
- kardos 10y agoFrom the thermal photo in the article, it looks like you get the sequence based on the residual heat intensity. Re-using digits would complicate that a bit, but I don't think pressing half of the buttons randomly before entering the real code eliminates the attack vector.
- knodi123 10y agoA scramble-pad is a perfect solution to this issue. But if you're not going to allow that, but you will allow impractically complicated solutions, then I think you'd be better off asking them to use their pin in a math problem. The CPU could easily choose one that didn't require remainders, to keep it mentally simple.
- zeroer 10y agoSure. Just concatenate a 256-bit nonce to your PIN, calculate the SHA-512 of the concatenation, and then type the last 4 hex digits of the hash. Easy!
- knodi123 10y agoIn my head, in less than a few seconds, I can take any PIN, calculate AES-encrypt it with a randomly chosen key, calculate the MD5, multiply the result by 65536, and then quickly type the least-significant 4 hex digits. Is that good enough?
- Lost_BiomedE 10y agoFor more sensitive areas, scramble pads are usually used. Solves a lot of security issues if you think anyone will go through much effort to get into an area.
- cmdrfred 10y agoFor anyone curious like myself: https://www.identiv.com/products/physical-access/utrust-physical-access-readers/utrust-scramblepad-readers https://www.identiv.com/products/physical-access/utrust-phys...
- rahkiin 10y agoWouldn't this burn your fingers?
- ksenzee 10y agoThey meant 98 degrees Fahrenheit - body temperature.
- CapitalistCartr 10y ago98F (37C) is approx. body temperature, so of course, it wouldn't harm a human body.
- Philomath 10y agoThe classic units of measurement problem. As an Aerospace engineer, I state the importance of using the proper units in any calculation.
- nkassis 10y agoYeah valid point. I should know better having moved from a metric country (except for pool temperature for some reason) to the US ;p
- alex- 10y agoAnother (cheaper?) solution would be to randomise the location of the keys each unlock attempt. It would cause me a massive problem - I basically only remember my pattern
- prawn 10y agoOne of my banks does this for online PIN entry and it's amazing how much it slows you down not being able to do it via muscle memory.
- macspoofing 10y agoOr move the location of the keys around the screen (but keep the order)
- ComodoHacker 10y agoIt would also make it impossible to unlock device off-sight (in the pocket) and increase chances of shoulder-surfing. The proper solution would be let user draw some figure anywhere on the screen then OCR it.
- Qantourisc 10y agoAndroid -> Settings -> Lock screen -> Scramble pin layout. If you are talking in general, hmmm yea hard, especially if it's mandatory.
- test1235 10y agoI use a pattern for my unlock, and you don't even need thermal imaging - you can see the smear left on the screen by my finger.
- Groxx 10y agodownside: oil from your fingers would cause the touched zones to retain / lose heat at a different rate.
- CamelCaseName 10y agoI've seen heated keypads at ATMs.