this post was submitted on 02 Dec 2023
410 points (95.6% liked)

Technology

70365 readers
3583 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.

That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.

In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.

top 50 comments
sorted by: hot top controversial new old
[–] topinambour_rex@lemmy.world 89 points 2 years ago (2 children)

Use a speech to text and they won't be able to hear your keyboard strokes. I know, I'm a genius.

[–] popekingjoe@lemmy.world 27 points 2 years ago (1 children)

Who are you, who are so wise in the ways of science?

[–] kpw@kbin.social 16 points 2 years ago (2 children)
load more comments (2 replies)
load more comments (1 replies)
[–] Waldowal@lemmy.world 87 points 2 years ago (4 children)

New policy from the corporate office: If you are working in a public place, like a coffee shop, please scream while typing your login password.

[–] sanimalp@lemmy.world 41 points 2 years ago

I screamed my password and now I got hacked. Thanks for nothing!

[–] tourist@lemmy.world 9 points 2 years ago

use the onscreen keyboard

much more secure

why won't my bank stop calling me

load more comments (2 replies)
[–] Cronch@lemmy.world 81 points 2 years ago (1 children)

Quite scary considering the accuracy and how many open mics everyone is surrounded by without even realizing it. Not to mention if any content creator types their password while live streaming or recording they could get their accounts stolen.

[–] vareriu@lemmy.world 40 points 2 years ago (7 children)

One more reason to switch to a password manager, even though they could still find out the master password…

[–] qwertyqwertyqwerty@lemmy.one 26 points 2 years ago (1 children)

Probably still have some safety if you're using two-factor, or have a master key in addition to a password (e.g. 1Password).

[–] mosiacmango@lemm.ee 13 points 2 years ago* (last edited 2 years ago) (1 children)

Or use a local password safe like keepass.

load more comments (1 replies)
load more comments (6 replies)
[–] ultra@feddit.ro 80 points 2 years ago* (last edited 2 years ago) (1 children)
[–] paraphrand@lemmy.world 53 points 2 years ago (4 children)

Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.

[–] AmberPrince@kbin.social 34 points 2 years ago

I'll accept the risk. I need the clicky

[–] ryannathans@aussie.zone 11 points 2 years ago (2 children)

Good luck, I have a non standard key layout

[–] Llewellyn@lemm.ee 9 points 2 years ago (7 children)

It's still vulnerable to dictionary attacks

load more comments (7 replies)
load more comments (1 replies)
load more comments (2 replies)
[–] lolcatnip@reddthat.com 41 points 2 years ago (2 children)

This is why I always make sure there are no boffins around before I start typing.

[–] killeronthecorner@lemmy.world 13 points 2 years ago* (last edited 2 years ago)

If there are boffins around, I start typing out the GDPR guidelines in full

load more comments (1 replies)
[–] NAXLAB@lemmy.world 36 points 2 years ago (1 children)

I think I might have achieved security through obscurity. My custom keyboard is a unique shape and almost all the keys are one unit. Not only is it different enough from a traditional keyboard that the neural network probably won't understand it, the function layers I use obscure whether I'm typing a letter at all.

[–] Outsider9042@lemmy.world 33 points 2 years ago (2 children)
[–] Mr_Blott@lemmy.world 20 points 2 years ago (2 children)

Does that come with free fingerless gloves?

[–] Outsider9042@lemmy.world 15 points 2 years ago (1 children)

No, but it comes with your choice of flavoured frozen yoghurt.

[–] b000urns@lemmy.world 9 points 2 years ago (3 children)
load more comments (3 replies)
load more comments (1 replies)
[–] A_Random_Idiot@lemmy.world 9 points 2 years ago

I have a headache just looking at that.

[–] laurelraven@lemmy.blahaj.zone 36 points 2 years ago (3 children)

Not to be a jerk, but is this actually new? I've heard of this being done at least ten years ago...

On another note, one way to beat this (to a degree) would be to use an alternate keyboard like Dvorak (though you could probably code it to be able to detect that based on what's being typed)

[–] barsoap@lemm.ee 19 points 2 years ago (4 children)

I think it's largely been a state actor thing. Directional microphone to record your window from across the street, spend significant tax money on crunching numbers on a supercomputer to get at your password kind of thing, I think they already could do it in the 90s. Real-time 95% accuracy on a non-specialised device is a quite different ballpark: Now every skiddie can do it.

load more comments (4 replies)
[–] misophist@lemmy.world 17 points 2 years ago (2 children)

Coding for alternate key mappings is almost as trivial as detecting other languages.

load more comments (2 replies)
[–] frezik@midwest.social 10 points 2 years ago (2 children)

There has been previous work on this, yes. It required a dictionary of suggested words. That would make it useful for snooping most typing, but not for randomly generated passwords. This new technique doesn't seem to have that limitation.

load more comments (2 replies)
[–] kent_eh@lemmy.ca 26 points 2 years ago

I guess my typos are now a security feature!

[–] stoy@lemmy.zip 24 points 2 years ago (3 children)

I wonder if you need to train it on a specific keyboard before it will work it.

[–] Lemminary@lemmy.world 10 points 2 years ago (1 children)
[–] stoy@lemmy.zip 10 points 2 years ago (1 children)

That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.

I also notice that I slightly change my typing style between typing normally and entering my password.

load more comments (1 replies)
load more comments (2 replies)
[–] mski@lemmy.ca 23 points 2 years ago (1 children)

I'd be curious how well this approach translates to multi-lingual keyboard layouts. For english users, perhaps theres another benefit to non-QWERTY layouts (e.g. Colemak or Dvorak) after all? ... and two factor authentication should remain helpful I presume. Especially physical key methods with no audible characters typed (e.g. Yubikey, Titan, etc.)

[–] jrbaconcheese@yall.theatl.social 25 points 2 years ago

I was thinking the same, but it would be trivial for software to realize that “fnj xlg” maps to “the dog” with Colemak or Dvorak.

[–] FrankTheHealer@lemmy.world 17 points 2 years ago (10 children)

Can we normalise good but quiet keyboards. Like, I like the tactile feel of using a mechanical, but I hate the sound. Quieter mechanical keyboards aren't a thing but they should be. Now as a security measure if nothing else.

Also Dvorak keyboards I guess

[–] Pinecone@lemmy.world 19 points 2 years ago (2 children)

There are tons of quiet mechanical keyboards. I'm using a low profile optical switch that's quieter than my mouse clicks

load more comments (2 replies)
[–] VelociCatTurd@lemmy.world 15 points 2 years ago (1 children)

There are definitely quiet tactile switches. The reason why they can still make sound is because they’re bottoming out which you don’t have to do.

[–] Cethin@lemmy.zip 8 points 2 years ago

As a partial solution, you can put o-rings in the keycaps. I had some of the bands for braces laying around at one point and used those, and it worked fairly well.

[–] NAXLAB@lemmy.world 11 points 2 years ago* (last edited 2 years ago)

Dvorak is a cypher of Qwerty tho. Anything typed in Dvorak but transcribed as english can be reliably identified and decyphered

load more comments (7 replies)
[–] BearOfaTime@lemm.ee 11 points 2 years ago* (last edited 2 years ago) (1 children)

I never learned to touch-type, so my typing style is very different from most people though I can type fast enough for work.

My typing style only uses 3 fingers, and both hands type keys in the middle of the keyboard.

I wonder if this has any effect on accuracy?

Edit: Article states touch-typing can reduce accuracy. Wonder if that's because they type more softly than us tech gorillas who tend to bash on the keys?

[–] overlordror@lemmy.world 9 points 2 years ago (3 children)

I'm a touch typist who can reach 160wpm when I'm really flowing, I would guess the speed makes accuracy harder to distinguish individual keys than you pressing keys with three fingers.

[–] Dave@lemmy.nz 8 points 2 years ago (3 children)

I type an awful lot slower than you, and still it's faster than I can think. How do you think of what to type fast enough to type at 160wpm?

[–] flipht@kbin.social 9 points 2 years ago

Not the original person you responded to, but I type 120ish wpm. The trick is to try to tap into the same part of your brain that verbalizes words when you talk, rather than the part that composes stuff when you write.

load more comments (2 replies)
load more comments (2 replies)
[–] atrielienz@lemmy.world 10 points 2 years ago

How good does this work if there's other noise pollution? Like music playing etc?

load more comments
view more: next ›