Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.

That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.

In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.

  • Cronch@lemmy.world
    link
    fedilink
    English
    arrow-up
    57
    ·
    1 year ago

    Quite scary considering the accuracy and how many open mics everyone is surrounded by without even realizing it. Not to mention if any content creator types their password while live streaming or recording they could get their accounts stolen.

    • vareriu@lemmy.world
      link
      fedilink
      English
      arrow-up
      33
      ·
      1 year ago

      One more reason to switch to a password manager, even though they could still find out the master password…

      • qwertyqwertyqwerty@lemmy.one
        link
        fedilink
        English
        arrow-up
        20
        ·
        1 year ago

        Probably still have some safety if you’re using two-factor, or have a master key in addition to a password (e.g. 1Password).

      • Rai@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Password manager and the LOUDEST MECHANICAL KEYBOARD POSSIBLE you have NO idea what keys I’m pressing with my blues, bitches

        • dubyakay@lemmy.ca
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          1 year ago

          That’s the whole point though. The louder your keypresses the better.

          • Rai@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            edit-2
            1 year ago

            laptop

            laptop

            laptop

            I don’t think you read the article

            A loud ass mech keyboard would fuck this study up

    • azertyfun@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      10
      ·
      edit-2
      1 year ago

      This has been a known attack vector for years, and I wonder how no livestreamer has been (publicly) attacked in this way.

      I guess in large part this can be attributed to 2FA, passwords just aren’t worth much by themselves anymore (well I guess if someone is quick enough they can snipe the OTP as well, but streamers are rarely entering their 2FA while streaming since they’re on a trusted device).

      In fact the biggest attack vector I’d worry about is the infamous SMS 2FA, which is actually 1FA for password resets, which is actually 0FA “yes dear phone operator I am indeed Mister Beast please move my phone number to this new SIM”.

  • Waldowal@lemmy.world
    link
    fedilink
    English
    arrow-up
    57
    ·
    1 year ago

    New policy from the corporate office: If you are working in a public place, like a coffee shop, please scream while typing your login password.

  • paraphrand@lemmy.world
    link
    fedilink
    English
    arrow-up
    36
    ·
    1 year ago

    Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.

          • Wilzax@lemmy.world
            link
            fedilink
            English
            arrow-up
            5
            arrow-down
            1
            ·
            1 year ago

            ??? If you can map sound to qwerty keystroke placement, then it’s a simple matter of mono alphabetic substitution for other layouts to generate candidate texts. Using a dictionary attack to find more candidate layouts would absolutely work.

            • ryannathans@aussie.zone
              link
              fedilink
              English
              arrow-up
              5
              ·
              1 year ago

              No, all the timings change. You can’t just swap out the letters and hope it matches. Additionally I was responding to the poster claiming a dictionary attack on a password would work - only if it’s in the dictionary.

    • Duamerthrax@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Good luck making an acoustic map of the tens thousands of possible case, switch and key cap combinations.

  • mski@lemmy.ca
    link
    fedilink
    English
    arrow-up
    21
    ·
    1 year ago

    I’d be curious how well this approach translates to multi-lingual keyboard layouts. For english users, perhaps theres another benefit to non-QWERTY layouts (e.g. Colemak or Dvorak) after all? … and two factor authentication should remain helpful I presume. Especially physical key methods with no audible characters typed (e.g. Yubikey, Titan, etc.)

    • jrbaconcheese@yall.theatl.social
      link
      fedilink
      English
      arrow-up
      24
      ·
      1 year ago

      I was thinking the same, but it would be trivial for software to realize that “fnj xlg” maps to “the dog” with Colemak or Dvorak.

  • NAXLAB@lemmy.world
    link
    fedilink
    English
    arrow-up
    21
    ·
    1 year ago

    I think I might have achieved security through obscurity. My custom keyboard is a unique shape and almost all the keys are one unit. Not only is it different enough from a traditional keyboard that the neural network probably won’t understand it, the function layers I use obscure whether I’m typing a letter at all.

  • laurelraven@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    21
    arrow-down
    1
    ·
    1 year ago

    Not to be a jerk, but is this actually new? I’ve heard of this being done at least ten years ago…

    On another note, one way to beat this (to a degree) would be to use an alternate keyboard like Dvorak (though you could probably code it to be able to detect that based on what’s being typed)

    • barsoap@lemm.ee
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 year ago

      I think it’s largely been a state actor thing. Directional microphone to record your window from across the street, spend significant tax money on crunching numbers on a supercomputer to get at your password kind of thing, I think they already could do it in the 90s. Real-time 95% accuracy on a non-specialised device is a quite different ballpark: Now every skiddie can do it.

      • skulblaka@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Now every skiddie can do it.

        And this is the real, serious problem. Most people are pretty unlikely to stop a state sponsored spy operation no matter how careful they are. It’s barely worth worrying about unless you know for a fact you’re being tapped and that you will be killed about it, and even if you do know this the state can pull some space age bullshit out of their asses that doesn’t yet have a counter. Top secret military industrial research goes into maintaining that exact advantage every year, if they really want to get you, you will get got. But if Joey Dickbeater and his school friends can just point a mic at your window and then upload it to the Pass-o-Gram to decode it, you have a real problem. It’s like when TikTok kids figured out they can steal Kias with usb keys - if every teenager in America knows how to steal your car, its lifetime is going to be measured in minutes. Same with passwords.

        Sounds like it’s time to buy a bunch of random cherry switches and randomize them across my keyboard…

        • Ook the Librarian@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Sounds like it’s time to buy a bunch of random cherry switches and randomize them across my keyboard…

          And rotate them. While I don’t plan to waste my energy, having hot swap sockets and swapping a few around should thwart the attack. You would have to do it frequently enough that relevant training data gets wasted before it’s useful. I’m pretty paranoid, but not that much.

          I’ll just consider it good security hygiene to get a new keyboard often :)

          • barsoap@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Have you considered only re-doing the tinfoil wrapper every day? It should crackle differently every time.

    • frezik@midwest.social
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      There has been previous work on this, yes. It required a dictionary of suggested words. That would make it useful for snooping most typing, but not for randomly generated passwords. This new technique doesn’t seem to have that limitation.

    • ARk@lemm.ee
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      8
      ·
      1 year ago

      But instead they would hear the speech and translate that to text. No need to thank me.

  • stoy@lemmy.zip
    link
    fedilink
    English
    arrow-up
    13
    ·
    1 year ago

    I wonder if you need to train it on a specific keyboard before it will work it.

      • stoy@lemmy.zip
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.

        I also notice that I slightly change my typing style between typing normally and entering my password.

  • BearOfaTime@lemm.ee
    link
    fedilink
    English
    arrow-up
    12
    ·
    edit-2
    1 year ago

    I never learned to touch-type, so my typing style is very different from most people though I can type fast enough for work.

    My typing style only uses 3 fingers, and both hands type keys in the middle of the keyboard.

    I wonder if this has any effect on accuracy?

    Edit: Article states touch-typing can reduce accuracy. Wonder if that’s because they type more softly than us tech gorillas who tend to bash on the keys?

    • overlordror@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      I’m a touch typist who can reach 160wpm when I’m really flowing, I would guess the speed makes accuracy harder to distinguish individual keys than you pressing keys with three fingers.

      • Dave@lemmy.nz
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        1 year ago

        I type an awful lot slower than you, and still it’s faster than I can think. How do you think of what to type fast enough to type at 160wpm?

        • flipht@kbin.social
          link
          fedilink
          arrow-up
          11
          ·
          1 year ago

          Not the original person you responded to, but I type 120ish wpm. The trick is to try to tap into the same part of your brain that verbalizes words when you talk, rather than the part that composes stuff when you write.

        • overlordror@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          That speed is usually transcription for me, I’m listening to someone and type what I hear. Actual writing and composing a thought typing speed is closer to 120wpm or so. I learned to type on a typewriter which is much slower, current low profile mech keyboard contributes to faster typing speed too.

          • fruitycoder@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            6
            ·
            1 year ago

            It would have to be combined with a secure (no microphones) area during setup, but it seems like swapped biometric plus token would defeat this attack (password gathering). It would however not defeat generic data collection.

          • Earthwormjim91@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            It would eliminate someone being able to get your username or password via this method though. Because you never have to type them in.

            With my MacBook I can use either touchid or my watch to automatically unlock it, so I don’t even have to type my password in to get into my laptop. And then I use touchid and Keychain for all my passwords so I never have to type those in either.

  • bionicjoey@lemmy.ca
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    7
    ·
    1 year ago

    Isn’t boffin a derogatory term like “nerd”?

    What a dogshit headline.

    • IllNess@infosec.pub
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 year ago

      Article also uses the term “eggheads”.

      To go from keystroke sounds to actual letters, the eggheads recorded a person typing on a 16-inch 2021 MacBook Pro using a phone placed 17cm away and processed the sounds to get signatures of the keystrokes.

    • Silic0n_Alph4@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      3
      ·
      1 year ago

      It’s The Register - think the Financial Times for IT but in the style of The Sun/any other British tabloid. They do it for the lulz, if you will - don’t get too hung up on the headlines as the content is top quality.

    • BearOfaTime@lemm.ee
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      1
      ·
      1 year ago

      It can be. Being a boffin, I’m not offended. Up to the individual if they choose to be offended.

      • bionicjoey@lemmy.ca
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        2
        ·
        1 year ago

        Still shitty journalism to refer to researchers publishing their research in that way.

        • BearOfaTime@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          1 year ago

          Meh, I wear such labels as badges of honor. I sacrificed a bit along the way to develop knowledge, skills, competence - I’ve earned it. Thanks for acknowledging it.

          I also see such things in a humorous light. I mean us “boffins” can be such boffins at times. We can over-focus, get caught up on perfectionism, etc, etc. If’n ya can’t laugh at your own foibles, well, I don’t know what to say.

    • jpeps@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Maybe a US/UK divide? At least in the UK boffin is relatively inoffensive depending on how it’s used. Eg if I build a fusion reactor in my garden my neighbour might say “wow, look at what this boffin did!” and it would be a complement where boffin is a stand in for a word like genius, only with a tounge in cheek touch of jealousy.

      Thinking about it I would say that ‘nerd’ is typically putting someone down for their intelligence or interests, whereas boffin is a light insult while identifying the ‘boffin’ as being smarter than yourself.