Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.
That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.
In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.
Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.
I’ll accept the risk. I need the clicky
Good luck, I have a non standard key layout
It’s still vulnerable to dictionary attacks
Except it’s not
??? If you can map sound to qwerty keystroke placement, then it’s a simple matter of mono alphabetic substitution for other layouts to generate candidate texts. Using a dictionary attack to find more candidate layouts would absolutely work.
No, all the timings change. You can’t just swap out the letters and hope it matches. Additionally I was responding to the poster claiming a dictionary attack on a password would work - only if it’s in the dictionary.
Dvorak?
Good luck making an acoustic map of the tens thousands of possible case, switch and key cap combinations.
Middle management will finally get rid of clacky keyboards with this weird trick