17 ms·

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from the first scenario, and apply the findings in the second scenario.

hackernewds 3y ago
seems like a very niche case to be warranting the headline and Hackernews front page
yowzadave 3y ago
I guess more reason to just use a password manager to autofill your password?
- kypro 3y ago
  Or just use 2fa
  - bee_rider 3y ago
    If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is bad 2FA, but it is popular.
    - gleenn 3y ago
      Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
      - 3np 3y ago
        It's the "or just" being the issue there, not the "use 2fa".
    - GhostWhisperer 3y ago
      which is the point of 2fa – when the 1st factor fails the 2nd holds
  - barrotes 3y ago
    Now that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible
- jgtrosh 3y ago
  Only if it doesn't only rely on a master password
  - apendleton 3y ago
    A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.
    - belval 3y ago
      95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatterucorrect" for example is still intelligible.
      - TheCleric 3y ago
        On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
        llbeansandrice 3y ago
        Right. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password. You don’t need to guess every character.
        whelp_24 3y ago
dvngnt_ 3y ago
for a few years I've used rtx voice to remove keyboard typing and other background noise
TechBro8615 3y ago
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
- fatfingerd 3y ago
  Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
  - thereisnospork 3y ago
    What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
    - meepmorp 3y ago
      I've wanted to integrate a cap gun into a keyboard, basically a an old fashioned roll of paper caps and solenoid to whack 'em, triggered by exclamation points.
    - TheCleric 3y ago
      Adding a gain knob to my keyboard, be right back.
      - idbehold 3y ago
        When conducting coding interviews remotely I often switch from my mechanical keyboard to my laptop keyboard (for taking notes) because I know how annoying/distracting that sound can be on calls. Suffice it to say, having a gain knob on my mechanical keyboard would be wonderful.
      - someplaceguy 3y ago
        My mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...
bitshiftfaced 3y ago
I think maybe you wouldn't even need to see the keystrokes. Given enough examples of just audio, I wonder if you could work out the keys using the statistical letter patterns in language.
dools 3y ago
And there are therefore millions of hours of video that could be attack surface area already in the wild

hackernewds 3y ago

seems like a very niche case to be warranting the headline and Hackernews front page

yowzadave 3y ago

I guess more reason to just use a password manager to autofill your password?

kypro 3y ago
Or just use 2fa
- bee_rider 3y ago
  If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is bad 2FA, but it is popular.
  - gleenn 3y ago
    Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
    - 3np 3y ago
      It's the "or just" being the issue there, not the "use 2fa".
  - GhostWhisperer 3y ago
    which is the point of 2fa – when the 1st factor fails the 2nd holds
- barrotes 3y ago
  Now that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible
jgtrosh 3y ago
Only if it doesn't only rely on a master password
- apendleton 3y ago
  A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.
  - belval 3y ago
    95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatterucorrect" for example is still intelligible.
    - TheCleric 3y ago
      On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
      - llbeansandrice 3y ago
        Right. The comment above is saying even if you are incorrect in 2-5 keystrokes it’s not hard to guess the correct keystrokes if you’re using a sentence style password. You don’t need to guess every character.
      - whelp_24 3y ago

dvngnt_ 3y ago

for a few years I've used rtx voice to remove keyboard typing and other background noise

TechBro8615 3y ago

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

fatfingerd 3y ago
Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
- thereisnospork 3y ago
  What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
  - meepmorp 3y ago
    I've wanted to integrate a cap gun into a keyboard, basically a an old fashioned roll of paper caps and solenoid to whack 'em, triggered by exclamation points.
  - TheCleric 3y ago
    Adding a gain knob to my keyboard, be right back.
    - idbehold 3y ago
      When conducting coding interviews remotely I often switch from my mechanical keyboard to my laptop keyboard (for taking notes) because I know how annoying/distracting that sound can be on calls. Suffice it to say, having a gain knob on my mechanical keyboard would be wonderful.
    - someplaceguy 3y ago
      My mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...

bitshiftfaced 3y ago

I think maybe you wouldn't even need to see the keystrokes. Given enough examples of just audio, I wonder if you could work out the keys using the statistical letter patterns in language.

dools 3y ago

And there are therefore millions of hours of video that could be attack surface area already in the wild