8 ms·

Google Glass Snoopers Can Steal Your Passcode With a Glance

35 points by balbaugh 12y ago

ryanmcbride 12y ago
It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away. I hope this makes a push for more/better biometric locks on every day devices.
- sanswork 12y ago
  Biometrics are just passwords you can never change. In "something you know, something you have" the second probably shouldn't be something you can never change if compromised.
  - dublinben 12y ago
    Fingerprints are also one of the most promiscuous of biometric indicators possible. You leave your fingerprints just about everywhere you go, which can be picked up with some powder and sticky tape. I would never consider my fingerprint to be a secure form of identification, nor should systems be designed that make this assumption.
    - lotu 12y ago
      I don't know I can see fingerprints being more secure than 4 digit pin. I can watch people enter their 4 digit pin and memorize just by standing next to them on the subway. I can't do the same thing with a fingerprint.
      - dublinben 12y ago
        It's possible you could actually lift a usable fingerprint off the surface of a phone that you find. We leave them everywhere.
  - ryanmcbride 12y ago
    That's a good point. But while it's permanent it's at least harder to replicate for the time being.
- enraged_camel 12y ago
  >>It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away. The difference is that when you record someone with a non-wearable device, it's pretty obvious. In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity) if they are paying attention. With Glass though, who knows if you are recording or not? AFAIK there isn't a red "recording" light that comes on, right? So as far as people are concerned, you might just be casually glancing in their direction, except you aren't.
  - raldi 12y ago
    > In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity) That's not really true. It's very easy to take a picture while holding the phone in a way that makes it look as if you're just reading it.
  - codeka 12y ago
    From the article, they were able to capture the PIN code from across the street and two stories up using a camcorder. You're not even going see that person.
  - personZ 12y ago
    With Glass though, who knows if you are recording or not? Without Glass, who knows if you are recording or not. The hysterics (largely driven through anti-Google rhetoric, fwiw. People like Gruber are on the front-lines of anti-Glass hate) seem naively simplistic. In this case, there are people stealing your pin codes, and they do it in bulk, using tiny, concealed video devices that you never knew were there. And as for everyone else, any of them, and any of your environments, can be absolutely coated with surveillance devices. High capacity, very tiny cameras are literally low-single digit prices now. Singling out Google glass users is luddism that uses it as an easy bully victim in hopes that it makes technology suddenly regress. Only technology is long past it.
  - Oletros 12y ago
    > AFAIK there isn't a red "recording" light that comes on, right? Yes, there is
kator 12y ago
Funny I've always worried about the mobile keypads because on top of that they "echo" the character you typed. I'm paranoid and often try to shield the screen when I type in my password. That said there are so many cameras everywhere it's hard not to think that somewhere they got a good clean shot and could figure out my password. I don't use the same password on any two things so it's less useful to get my mobile lock password then it might be for some but if you have a lock screen pin or password you do get an amazing amount of stuff for free on a person's mobile device...
uses 12y ago
I'm not sure what I expected from comments on Wired, but that is pretty amazing that all the most highly-upvoted comments are calling Glass users "glassholes", pedophiles, and encouraging violence against them and/or their Glass devices.
- fletchowns 12y ago
  To be fair I've heard these same kind of comments in real life about Google Glass users.
- esbonsa 12y ago
  hopefully they are consistent and have the same comments about anyone having their phone out of their pocket
  - esbonsa 12y ago
    Can someone explain why "phones" should not be considered a treat to privacy if you think Google Glass is?
    - gress 12y ago
      You can see what people are doing with phones.
      - Oletros 12y ago
        Really? More than with a device that has a LED on when it is recording? If you can see what is done with an smartphone how is there are such a number of subreptitious videos and pictures taken with smartphones
        gress 12y ago
        Google Glass does not have an LED on it when it is recording. And yes, it is possible to make a surreptitious recording with any camera, but there is no comparison. With other cameras including cellphones, it takes a tricky and intentional effort, with the risk of social consequences if discovered. Glass is designed to make it ubiquitous and effortless to record people, with no indication to those being surveilled.
lvs 12y ago
You know what else can steal your passcode with a glance? My eyeballs.
- CanSpice 12y ago
  From 44 meters away?
- enraged_camel 12y ago
  Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information. Not only that, you can also be recording the person, and can later look up their face, potentially figure out their identity, and then proceed with identity theft. You can't do that with just your eyeballs.
  - dragonwriter 12y ago
    > Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information. Google glass didn't make that possible, the invention of the video camera did. Plenty of those around -- often in compact form -- with or without Glass.
    - Tycho 12y ago
      But you'd look pretty damn conspicuous holding up a camera while someone was entering passwords or accessing sensitive info.
      - dragonwriter 12y ago
        > But you'd look pretty damn conspicuous holding up a camera while someone was entering passwords or accessing sensitive info. Not at the distance from which a decent camera (as discussed in the article) can capture it, you wouldn't -- what Glass can do from 3 meters away, the camera they tested in the article could -- with greater reliability -- through a window 44 meters away (four stories up and across a street).
techwizrd 12y ago
The comments in the Wired article are pretty ridiculous and it seems as if the article title is pretty sensational. The article also mentions that a Samsung smartwatch is just as accurate and an iPhone 5 camera caught the PIN every time. According to the article, a person with a $700 Panasonic camcorder can steal your PIN from 4 stories up and across the street. You don't, however, see any of the commenters in the article calling people with camcorders pedophiles and asking for them to beaten up. The hysteria is ridiculous. I think the solution given by the article researchers that randomizes the locations of the numbers on the PIN entry is a much more effective solution than wantonly destroying people's property or assaulting them because of a perceived, imaginary threat.
- mikecb 12y ago
  Unfortunately, randomizing the button locations would be an accessibility nightmare.
  - dublinben 12y ago
    Security and accessibility are pretty much inherently opposed.
    - schoen 12y ago
      That brings to mind this tweet by Eleanor Saitta on a specific instance where they actually are directly opposed. https://twitter.com/Dymaxion/status/464457530677420034 https://twitter.com/Dymaxion/status/464457530677420034 (It's a case where physical security and physical accessibility come in pretty direct conflict!)
  - CSDude 12y ago
    It is a standard for many banks in Turkey, since we only enter PIN
  - ryanmcbride 12y ago
    Runescape's been doing it for years.
rbanffy 12y ago
We'll have to adjust to a world where everyone has perfect visual memory and superhuman time perception.
- schoen 12y ago
  This brings to mind the plot of Isaac Asimov's story "Lest We Remember". https://en.wikipedia.org/wiki/Lest_We_Remember https://en.wikipedia.org/wiki/Lest_We_Remember That title was also the inspiration for the title of a paper I worked on: https://citp.princeton.edu/research/memory/ https://citp.princeton.edu/research/memory/
lugg 12y ago
> “I think of this as a kind of alert about Google Glass, smartwatches, all these devices,” Why is it that its always a fault with the new tech? I'm not a glass esplorer but still I take offense to this kind of idiocy. The problem is with passcodes/passwords in general, they have always been susceptible to this kind of attack, adding in a video recorder doesn't change this.
daenz 12y ago
Seems like an easy solution: randomize the PIN keypad layout with every key press.
- TOMDM 12y ago
  If you wanted to take it a step further, the touch screen could have a very narrow viewing angle, have the angle of the screen automatically or manually rotate to the users eye level, and then someone standing next to you would just see a blank screen. With random keys on top of that, someone would literally have to poke their head over your shoulder to see.
- snogglethorpe 12y ago
  If they're going to do that, they need to do it consistently... Most ATMs around here don't randomize the layout, but every once in a while I come across one that does, and I've found that it's actually quite difficult to use the latter. Apparently I have my PIN memorized mainly through muscle memory... when using the randomized sort I've occasionally resorted to drawing a keyboard and looking at what numbers my fingers hit! ><
CSDude 12y ago
Another anti-Google propoganda with highly offensive comments (pedophile, glasshole etc.) with high upvotes and not a single downvote. You can do the exact same thing by hiding a camera in anywhere your body, and they won't even be spotted like Google Glass. There are cameras as tiny as: http://youtu.be/CgtTg62GDfs?t=2m19s http://youtu.be/CgtTg62GDfs?t=2m19s and I'm sure many intelligency agencies around the world have better cameras than this on their agents, and some one might be actually using them. Additionally, almost all the stores has security cameras, which are on top of you and potentially can do the same thing, and you won't even notice.
- gress 12y ago
  Which giant corporation is trying to popularize the daily use of these other cameras?
  - gbog 12y ago
    You mean a big startup creating new projects in many different directions, automated cars, wifi balloons, space elevator, open source os for mobile devices, and smart spectacles?
    - gress 12y ago
      Do space elevators make it ok to invade people's privacy?
- megablast 12y ago
  And more pro Google propaganda, that seems to popup whenever anyone criticizes google glasses. Even now, I would suggest there are more google glass wearers than people with hidden cameras.
userbinator 12y ago
I think it's a little odd that screens on personal devices are going in the direction of super-high viewing angles and brightness, as if letting everyone else besides you see what you're doing is a good thing... even the unbranded low-end Android I have has a screen with nearly 180 degrees of viewing angle. However, this with a randomised button layout solve the problem quite well: http://solutions.3m.com/wps/portal/3M/en_US/SDP_NaturalView/screenprotector/cell-screen-protector/mobile-privacy-film/ http://solutions.3m.com/wps/portal/3M/en_US/SDP_NaturalView/...
gbog 12y ago
It is weird to not see a single comment calling for the long due death of passwords as authentication. They have so many drawbacks, they are annoying each and every employee that works with a computer on earth, we have weekly massive password leakage posts on HN (only tip of the iceberg), and apart from fingerprints there is no contender? Guys, startup creators, hackers, engineers: wake up! Find something, anything! In 30 years, when passwords will be past, our future selves will be amazed to read stories about passwords: how could we bear this skyscraping level of stupidity and annoyance.

35 points by balbaugh 12y ago

It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away. I hope this makes a push for more/better biometric locks on every day devices.

sanswork 12y ago
Biometrics are just passwords you can never change. In "something you know, something you have" the second probably shouldn't be something you can never change if compromised.
- dublinben 12y ago
  Fingerprints are also one of the most promiscuous of biometric indicators possible. You leave your fingerprints just about everywhere you go, which can be picked up with some powder and sticky tape. I would never consider my fingerprint to be a secure form of identification, nor should systems be designed that make this assumption.
  - lotu 12y ago
    I don't know I can see fingerprints being more secure than 4 digit pin. I can watch people enter their 4 digit pin and memorize just by standing next to them on the subway. I can't do the same thing with a fingerprint.
    - dublinben 12y ago
      It's possible you could actually lift a usable fingerprint off the surface of a phone that you find. We leave them everywhere.
- ryanmcbride 12y ago
  That's a good point. But while it's permanent it's at least harder to replicate for the time being.
enraged_camel 12y ago
>>It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away. The difference is that when you record someone with a non-wearable device, it's pretty obvious. In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity) if they are paying attention. With Glass though, who knows if you are recording or not? AFAIK there isn't a red "recording" light that comes on, right? So as far as people are concerned, you might just be casually glancing in their direction, except you aren't.
- raldi 12y ago
  > In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity) That's not really true. It's very easy to take a picture while holding the phone in a way that makes it look as if you're just reading it.
- codeka 12y ago
  From the article, they were able to capture the PIN code from across the street and two stories up using a camcorder. You're not even going see that person.
- personZ 12y ago
  With Glass though, who knows if you are recording or not? Without Glass, who knows if you are recording or not. The hysterics (largely driven through anti-Google rhetoric, fwiw. People like Gruber are on the front-lines of anti-Glass hate) seem naively simplistic. In this case, there are people stealing your pin codes, and they do it in bulk, using tiny, concealed video devices that you never knew were there. And as for everyone else, any of them, and any of your environments, can be absolutely coated with surveillance devices. High capacity, very tiny cameras are literally low-single digit prices now. Singling out Google glass users is luddism that uses it as an easy bully victim in hopes that it makes technology suddenly regress. Only technology is long past it.
- Oletros 12y ago
  > AFAIK there isn't a red "recording" light that comes on, right? Yes, there is

kator 12y ago

Funny I've always worried about the mobile keypads because on top of that they "echo" the character you typed. I'm paranoid and often try to shield the screen when I type in my password. That said there are so many cameras everywhere it's hard not to think that somewhere they got a good clean shot and could figure out my password. I don't use the same password on any two things so it's less useful to get my mobile lock password then it might be for some but if you have a lock screen pin or password you do get an amazing amount of stuff for free on a person's mobile device...

uses 12y ago

I'm not sure what I expected from comments on Wired, but that is pretty amazing that all the most highly-upvoted comments are calling Glass users "glassholes", pedophiles, and encouraging violence against them and/or their Glass devices.

fletchowns 12y ago
To be fair I've heard these same kind of comments in real life about Google Glass users.
esbonsa 12y ago
hopefully they are consistent and have the same comments about anyone having their phone out of their pocket
- esbonsa 12y ago
  Can someone explain why "phones" should not be considered a treat to privacy if you think Google Glass is?
  - gress 12y ago
    You can see what people are doing with phones.
    - Oletros 12y ago
      Really? More than with a device that has a LED on when it is recording? If you can see what is done with an smartphone how is there are such a number of subreptitious videos and pictures taken with smartphones
      - gress 12y ago
        Google Glass does not have an LED on it when it is recording. And yes, it is possible to make a surreptitious recording with any camera, but there is no comparison. With other cameras including cellphones, it takes a tricky and intentional effort, with the risk of social consequences if discovered. Glass is designed to make it ubiquitous and effortless to record people, with no indication to those being surveilled.

lvs 12y ago

You know what else can steal your passcode with a glance? My eyeballs.

CanSpice 12y ago
From 44 meters away?
enraged_camel 12y ago
Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information. Not only that, you can also be recording the person, and can later look up their face, potentially figure out their identity, and then proceed with identity theft. You can't do that with just your eyeballs.
- dragonwriter 12y ago
  > Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information. Google glass didn't make that possible, the invention of the video camera did. Plenty of those around -- often in compact form -- with or without Glass.
  - Tycho 12y ago
    But you'd look pretty damn conspicuous holding up a camera while someone was entering passwords or accessing sensitive info.
    - dragonwriter 12y ago
      > But you'd look pretty damn conspicuous holding up a camera while someone was entering passwords or accessing sensitive info. Not at the distance from which a decent camera (as discussed in the article) can capture it, you wouldn't -- what Glass can do from 3 meters away, the camera they tested in the article could -- with greater reliability -- through a window 44 meters away (four stories up and across a street).

techwizrd 12y ago

The comments in the Wired article are pretty ridiculous and it seems as if the article title is pretty sensational. The article also mentions that a Samsung smartwatch is just as accurate and an iPhone 5 camera caught the PIN every time. According to the article, a person with a $700 Panasonic camcorder can steal your PIN from 4 stories up and across the street. You don't, however, see any of the commenters in the article calling people with camcorders pedophiles and asking for them to beaten up. The hysteria is ridiculous. I think the solution given by the article researchers that randomizes the locations of the numbers on the PIN entry is a much more effective solution than wantonly destroying people's property or assaulting them because of a perceived, imaginary threat.

mikecb 12y ago
Unfortunately, randomizing the button locations would be an accessibility nightmare.
- dublinben 12y ago
  Security and accessibility are pretty much inherently opposed.
  - schoen 12y ago
    That brings to mind this tweet by Eleanor Saitta on a specific instance where they actually are directly opposed. https://twitter.com/Dymaxion/status/464457530677420034 https://twitter.com/Dymaxion/status/464457530677420034 (It's a case where physical security and physical accessibility come in pretty direct conflict!)
- CSDude 12y ago
  It is a standard for many banks in Turkey, since we only enter PIN
- ryanmcbride 12y ago
  Runescape's been doing it for years.

rbanffy 12y ago

We'll have to adjust to a world where everyone has perfect visual memory and superhuman time perception.

schoen 12y ago
This brings to mind the plot of Isaac Asimov's story "Lest We Remember". https://en.wikipedia.org/wiki/Lest_We_Remember https://en.wikipedia.org/wiki/Lest_We_Remember That title was also the inspiration for the title of a paper I worked on: https://citp.princeton.edu/research/memory/ https://citp.princeton.edu/research/memory/

lugg 12y ago

> “I think of this as a kind of alert about Google Glass, smartwatches, all these devices,” Why is it that its always a fault with the new tech? I'm not a glass esplorer but still I take offense to this kind of idiocy. The problem is with passcodes/passwords in general, they have always been susceptible to this kind of attack, adding in a video recorder doesn't change this.

daenz 12y ago

Seems like an easy solution: randomize the PIN keypad layout with every key press.

TOMDM 12y ago
If you wanted to take it a step further, the touch screen could have a very narrow viewing angle, have the angle of the screen automatically or manually rotate to the users eye level, and then someone standing next to you would just see a blank screen. With random keys on top of that, someone would literally have to poke their head over your shoulder to see.
snogglethorpe 12y ago
If they're going to do that, they need to do it consistently... Most ATMs around here don't randomize the layout, but every once in a while I come across one that does, and I've found that it's actually quite difficult to use the latter. Apparently I have my PIN memorized mainly through muscle memory... when using the randomized sort I've occasionally resorted to drawing a keyboard and looking at what numbers my fingers hit! ><

CSDude 12y ago

Another anti-Google propoganda with highly offensive comments (pedophile, glasshole etc.) with high upvotes and not a single downvote. You can do the exact same thing by hiding a camera in anywhere your body, and they won't even be spotted like Google Glass. There are cameras as tiny as: http://youtu.be/CgtTg62GDfs?t=2m19s http://youtu.be/CgtTg62GDfs?t=2m19s and I'm sure many intelligency agencies around the world have better cameras than this on their agents, and some one might be actually using them. Additionally, almost all the stores has security cameras, which are on top of you and potentially can do the same thing, and you won't even notice.

gress 12y ago
Which giant corporation is trying to popularize the daily use of these other cameras?
- gbog 12y ago
  You mean a big startup creating new projects in many different directions, automated cars, wifi balloons, space elevator, open source os for mobile devices, and smart spectacles?
  - gress 12y ago
    Do space elevators make it ok to invade people's privacy?
megablast 12y ago
And more pro Google propaganda, that seems to popup whenever anyone criticizes google glasses. Even now, I would suggest there are more google glass wearers than people with hidden cameras.

userbinator 12y ago

I think it's a little odd that screens on personal devices are going in the direction of super-high viewing angles and brightness, as if letting everyone else besides you see what you're doing is a good thing... even the unbranded low-end Android I have has a screen with nearly 180 degrees of viewing angle. However, this with a randomised button layout solve the problem quite well: http://solutions.3m.com/wps/portal/3M/en_US/SDP_NaturalView/screenprotector/cell-screen-protector/mobile-privacy-film/ http://solutions.3m.com/wps/portal/3M/en_US/SDP_NaturalView/...

gbog 12y ago

It is weird to not see a single comment calling for the long due death of passwords as authentication. They have so many drawbacks, they are annoying each and every employee that works with a computer on earth, we have weekly massive password leakage posts on HN (only tip of the iceberg), and apart from fingerprints there is no contender? Guys, startup creators, hackers, engineers: wake up! Find something, anything! In 30 years, when passwords will be past, our future selves will be amazed to read stories about passwords: how could we bear this skyscraping level of stupidity and annoyance.