this post was submitted on 02 Dec 2023
441 points (95.7% liked)

Technology

59719 readers
2248 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
441
Boffins convert typing sounds into text with 95% accuracy (www.theregister.com)
submitted 1 year ago by [email protected] to c/[email protected]
145 comments fedilink hide all child comments
 

Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.

That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.

In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 6 points 1 year ago* (last edited 1 year ago) (4 children)

The problems is that even with up to 95% accuracy that still means the with a password length of 10 there is a 50/50 chance that one character is wrong.

A password with one character wrong is just as useless as randomly typing.

Which character is wrong and what should it be? You only have 2 or 3 more guess till most systems will lock the account.

This is an interesting academic exercise but there are much better and easier ways to gain access to passwords and systems.

The world is not a bond movie.

Deploying social engineering is much easier than this sort of attack.

[–] [email protected] 5 points 1 year ago

"Hearing" the same password twice drastically increases the accuracy, however, social engineering is indeed the most effective and efficient attack method.

[–] [email protected] 4 points 1 year ago

If the password is not random, as they seldomly are, you can just guess the last, or even the last few characters of they are not correct.

[–] prole 3 points 1 year ago* (last edited 1 year ago)

The world is not a bond movie.

Deploying social engineering is much easier than this sort of attack.

Have you never seen a Bond movie? Yeah they always have a gadget or two, but the rest is basically him social engineering his way through the film. And shooting. Usually lots of shooting too.

[–] [email protected] 2 points 1 year ago

I was thinking of this attack in terms of grabbing emails, documents, stuff like that. Or snippets thereof.