5 ms·

The comments in the Wired article are pretty ridiculous and it seems as if the article title is pretty sensational. The article also mentions that a Samsung sma

The comments in the Wired article are pretty ridiculous and it seems as if the article title is pretty sensational. The article also mentions that a Samsung smartwatch is just as accurate and an iPhone 5 camera caught the PIN every time. According to the article, a person with a $700 Panasonic camcorder can steal your PIN from 4 stories up and across the street. You don't, however, see any of the commenters in the article calling people with camcorders pedophiles and asking for them to beaten up. The hysteria is ridiculous. I think the solution given by the article researchers that randomizes the locations of the numbers on the PIN entry is a much more effective solution than wantonly destroying people's property or assaulting them because of a perceived, imaginary threat.

mikecb 12y ago
Unfortunately, randomizing the button locations would be an accessibility nightmare.
- dublinben 12y ago
  Security and accessibility are pretty much inherently opposed.
  - schoen 12y ago
    That brings to mind this tweet by Eleanor Saitta on a specific instance where they actually are directly opposed. https://twitter.com/Dymaxion/status/464457530677420034 https://twitter.com/Dymaxion/status/464457530677420034 (It's a case where physical security and physical accessibility come in pretty direct conflict!)
- CSDude 12y ago
  It is a standard for many banks in Turkey, since we only enter PIN
- ryanmcbride 12y ago
  Runescape's been doing it for years.
- lstamour 12y ago
  Not if you can move your finger and listen for the number via VoiceOver. And if it's not on by default. That said, I wonder if one could make a tap pattern password for blind folks and finger drummers ;-)
lstamour 12y ago
If I can use a custom keyboard to enter my iPad pin code -- problem solved? I'd of course point out that the pin code is the least of your worries given most apps' security when on unsecured wifi... Besides, this really is nothing new, as people have been remotely stealing PIN numbers for ages, even recruiting others to do it for them. That this is an iPad instead of a PIN pad doesn't make much difference. That all said, I'm sure more people will buy into fingerprint passwords from articles like this ... which is just as insecure, someone can easily get your prints if they wanted to. Perhaps we need a bluetooth Yubikey plus manual entry for 2FA ;-)
thegeomaster 12y ago
Randomizing the locations can help, but if the camera sees your display, you're screwed anyway. I guess you just need to be more careful about others' lines of sight when you're entering sensitive data. Someone may be spying over your shoulder, as well. Regarding the comments: they may seem ridiculous after you've been browsing HN and reading the comments on here. The kind of discussion on that Wired article is not any worse than your average Internet discussion, it's just that HN raises your bar because it targets a narrower demographic. Such niche communities tend to have the most sane behavior of users; on the other end is 4chan's Random board where "everything goes", and look at it, it's the asshole of the Internet.

mikecb 12y ago

Unfortunately, randomizing the button locations would be an accessibility nightmare.

dublinben 12y ago
Security and accessibility are pretty much inherently opposed.
- schoen 12y ago
  That brings to mind this tweet by Eleanor Saitta on a specific instance where they actually are directly opposed. https://twitter.com/Dymaxion/status/464457530677420034 https://twitter.com/Dymaxion/status/464457530677420034 (It's a case where physical security and physical accessibility come in pretty direct conflict!)
CSDude 12y ago
It is a standard for many banks in Turkey, since we only enter PIN
ryanmcbride 12y ago
Runescape's been doing it for years.
lstamour 12y ago
Not if you can move your finger and listen for the number via VoiceOver. And if it's not on by default. That said, I wonder if one could make a tap pattern password for blind folks and finger drummers ;-)

lstamour 12y ago

If I can use a custom keyboard to enter my iPad pin code -- problem solved? I'd of course point out that the pin code is the least of your worries given most apps' security when on unsecured wifi... Besides, this really is nothing new, as people have been remotely stealing PIN numbers for ages, even recruiting others to do it for them. That this is an iPad instead of a PIN pad doesn't make much difference. That all said, I'm sure more people will buy into fingerprint passwords from articles like this ... which is just as insecure, someone can easily get your prints if they wanted to. Perhaps we need a bluetooth Yubikey plus manual entry for 2FA ;-)

thegeomaster 12y ago

Randomizing the locations can help, but if the camera sees your display, you're screwed anyway. I guess you just need to be more careful about others' lines of sight when you're entering sensitive data. Someone may be spying over your shoulder, as well. Regarding the comments: they may seem ridiculous after you've been browsing HN and reading the comments on here. The kind of discussion on that Wired article is not any worse than your average Internet discussion, it's just that HN raises your bar because it targets a narrower demographic. Such niche communities tend to have the most sane behavior of users; on the other end is 4chan's Random board where "everything goes", and look at it, it's the asshole of the Internet.