4 ms·

I was a little skeptical, so I followed the link trail to the actual paper: https://www.comp.nus.edu.sg/~junhan/papers/SpiKey_HotMobile20_CamReady.pdf https://w

I was a little skeptical, so I followed the link trail to the actual paper: https://www.comp.nus.edu.sg/~junhan/papers/SpiKey_HotMobile20_CamReady.pdf https://www.comp.nus.edu.sg/~junhan/papers/SpiKey_HotMobile2... They did not take a recording of an actual key in an actual lock and determine the shape of the key. Instead they simulated the sound of a key in a lock, and determined the shape of the key from that simulated sound. And the simulation assumed that the speed that the key moves at is fixed as it enters the lock, at 1 inch per second. So this article is false. It wouldn't have been that hard to read the paper, and say what they actually did. It bothers me that articles like this don't, and instead run with an exaggeration. EDIT: As far as I can tell from the paper, at least. What on earth is a "simulation, based on real-world recordings"? I don't see anything about an actual recording in section 4.

wmichelin 6y ago
People like you are what keep me coming back to sites like this. Thank you for actually reading the paper and discussing reality with us.
- ajraman 6y ago
  +1
- justinpombrio 6y ago
  Aww, thank you. FYI it was very little effort. You can do it too! I followed two links to the paper, looked for "how did they test this thing" (because I was skeptical about that bit), then skimmed the three paragraphs in section 4 "Feasibility Study". I'm hoping that people that care more than I do will read more.
  - anjanb 6y ago
    Thanks very much for the encouragement.
- thih9 6y ago
  No need to praise for that behavior, it’s just one person doing their research; this should be the default.
  - brujoand 6y ago
    There is seldom need for praise, that's what makes the praise mean something. Some stranger took the time to thank a person for doing something. Huge high five, probably felt good for both of them. I don't think we should discourage positive human interaction.
    - thih9 6y ago
      It still feels to me like praising somebody for doing something mundane, e.g. washing their hands. Sure, a positive interaction and rewarding something important. At the same time we shouldn’t forget to aim to make this behavior commonplace.
      - MarcellusDrum 6y ago
        Someone holding the door open for me if I'm right behind them is a mundane thing and should be the default, but I still thank them for it.
donw 6y ago
At some point, it may be possible to leverage this, but I agree: at present, it's a purely theoretical compromise, and you'd be better served by either picking the lock -- which might be as simple as just raking some pins -- or by re-creating the key from an image[1]. The image attack offers way more opportunities there, as you just need to be able to see the key (as opposed to the hypothetical sound attack, which requires that you capture the sound of the lock being unlocked). As an aside, If you're keen to learn more about locks and security, I suggest having a look at LockPickingLawyer on YouTube[2]. [1] https://www.youtube.com/watch?v=AayXf5aRFTI https://www.youtube.com/watch?v=AayXf5aRFTI [2] https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
phire 6y ago
No, I'm pretty sure they used a real recording. They link the actual recording in section 3.1: http://bit.ly/2JciYB6 http://bit.ly/2JciYB6 What they are saying is to find their target keys, they physically modelled 330,424 candidate keys, generated an acoustic simulation and then ran the acoustic simulation of clicks though the tool described in sections 3.1 to 3.6. They used the insertion speed of 1 inch per second for this physical simulation of candidate keys. Then they compared the output of the tool on all the candidates to the output from the original real recording to see which ones lined up the best.
- justinpombrio 6y ago
  Thanks for looking deeper, I was hoping someone would. You're right about the purpose of the simulation. What I'm confused about is, I would expect them to say that they ran that recording through SpiKey, and it output 3 (or however many) candidates, and the actual key was (or wasn't) one of the three. But instead, that bit.ly link is provided for "better understanding", and the rest of the section it's in is about the tool in general, rather than a specific test of it. Was it one actual recording they tested, you think? Do they say whether the actual key was among the candidates?
  - londons_explore 6y ago
    Are you suggesting the authors failed to get their theoretical attack to work, yet left that detail out of the paper? Pretty shady if so...
EdSchouten 6y ago
I find it funny how they use Beastie (BSD's mascot) to refer to an attacker, in figure 1 of the paper.
ChrisLomont 6y ago
All throughout the paper they state they used a phone mic. They have a section on the filtering they needed on the real world audio to extract the information they needed. The conclusion even states “ We evaluate SpiKey with a proof-of-concept simulation, based on real-world acoustic data, and demonstrate that SpiKey can reduce the search space from a pool of more than 330 thousand keys to just three candidate keys for the most frequent case.” Why do you claim it’s not real audio?
- justinpombrio 6y ago
  Section 4 definitely starts with an actual audio recording. But it ends with Figure 7, which shows the relationship between all possible keys and their simulated sounds. The simulation was "based on real-world acoustic data", but figure 7 is not a property of a single actual recording, it is a property of all simulated recordings. You could still be right. I've been reading again, and I'm having a hard time telling apart statements about how their tool works in general, vs. statements of a particular test of it. If they actually tested this thing end-to-end, I would expect to be able to answer (i) how many actual key recordings did they test it on?, and (ii) did it work? Was the actual key found among the 3 (or however many) candidates?
deleted 6y ago
[deleted]
dang 6y ago
We've changed the URL to that now, from https://kottke.org/20/08/researchers-can-duplicate-keys-from-the-sounds-they-make-in-locks https://kottke.org/20/08/researchers-can-duplicate-keys-from....

wmichelin 6y ago

People like you are what keep me coming back to sites like this. Thank you for actually reading the paper and discussing reality with us.

ajraman 6y ago
+1
justinpombrio 6y ago
Aww, thank you. FYI it was very little effort. You can do it too! I followed two links to the paper, looked for "how did they test this thing" (because I was skeptical about that bit), then skimmed the three paragraphs in section 4 "Feasibility Study". I'm hoping that people that care more than I do will read more.
- anjanb 6y ago
  Thanks very much for the encouragement.
thih9 6y ago
No need to praise for that behavior, it’s just one person doing their research; this should be the default.
- brujoand 6y ago
  There is seldom need for praise, that's what makes the praise mean something. Some stranger took the time to thank a person for doing something. Huge high five, probably felt good for both of them. I don't think we should discourage positive human interaction.
  - thih9 6y ago
    It still feels to me like praising somebody for doing something mundane, e.g. washing their hands. Sure, a positive interaction and rewarding something important. At the same time we shouldn’t forget to aim to make this behavior commonplace.
    - MarcellusDrum 6y ago
      Someone holding the door open for me if I'm right behind them is a mundane thing and should be the default, but I still thank them for it.

donw 6y ago

At some point, it may be possible to leverage this, but I agree: at present, it's a purely theoretical compromise, and you'd be better served by either picking the lock -- which might be as simple as just raking some pins -- or by re-creating the key from an image[1]. The image attack offers way more opportunities there, as you just need to be able to see the key (as opposed to the hypothetical sound attack, which requires that you capture the sound of the lock being unlocked). As an aside, If you're keen to learn more about locks and security, I suggest having a look at LockPickingLawyer on YouTube[2]. [1] https://www.youtube.com/watch?v=AayXf5aRFTI https://www.youtube.com/watch?v=AayXf5aRFTI [2] https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

phire 6y ago

No, I'm pretty sure they used a real recording. They link the actual recording in section 3.1: http://bit.ly/2JciYB6 http://bit.ly/2JciYB6 What they are saying is to find their target keys, they physically modelled 330,424 candidate keys, generated an acoustic simulation and then ran the acoustic simulation of clicks though the tool described in sections 3.1 to 3.6. They used the insertion speed of 1 inch per second for this physical simulation of candidate keys. Then they compared the output of the tool on all the candidates to the output from the original real recording to see which ones lined up the best.

justinpombrio 6y ago
Thanks for looking deeper, I was hoping someone would. You're right about the purpose of the simulation. What I'm confused about is, I would expect them to say that they ran that recording through SpiKey, and it output 3 (or however many) candidates, and the actual key was (or wasn't) one of the three. But instead, that bit.ly link is provided for "better understanding", and the rest of the section it's in is about the tool in general, rather than a specific test of it. Was it one actual recording they tested, you think? Do they say whether the actual key was among the candidates?
- londons_explore 6y ago
  Are you suggesting the authors failed to get their theoretical attack to work, yet left that detail out of the paper? Pretty shady if so...

EdSchouten 6y ago

I find it funny how they use Beastie (BSD's mascot) to refer to an attacker, in figure 1 of the paper.

ChrisLomont 6y ago

All throughout the paper they state they used a phone mic. They have a section on the filtering they needed on the real world audio to extract the information they needed. The conclusion even states “ We evaluate SpiKey with a proof-of-concept simulation, based on real-world acoustic data, and demonstrate that SpiKey can reduce the search space from a pool of more than 330 thousand keys to just three candidate keys for the most frequent case.” Why do you claim it’s not real audio?

justinpombrio 6y ago
Section 4 definitely starts with an actual audio recording. But it ends with Figure 7, which shows the relationship between all possible keys and their simulated sounds. The simulation was "based on real-world acoustic data", but figure 7 is not a property of a single actual recording, it is a property of all simulated recordings. You could still be right. I've been reading again, and I'm having a hard time telling apart statements about how their tool works in general, vs. statements of a particular test of it. If they actually tested this thing end-to-end, I would expect to be able to answer (i) how many actual key recordings did they test it on?, and (ii) did it work? Was the actual key found among the 3 (or however many) candidates?

deleted 6y ago

[deleted]

dang 6y ago

We've changed the URL to that now, from https://kottke.org/20/08/researchers-can-duplicate-keys-from-the-sounds-they-make-in-locks https://kottke.org/20/08/researchers-can-duplicate-keys-from....