Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.
That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.
In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.
Use a speech to text and they won’t be able to hear your keyboard strokes. I know, I’m a genius.
Who are you, who are so wise in the ways of science?
A duck.
Got any grapes?
I mean, I got lemonade…
But instead they would hear the speech and translate that to text. No need to thank me.
Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.
I’ll accept the risk. I need the clicky
Good luck, I have a non standard key layout
It’s still vulnerable to dictionary attacks
Except it’s not
??? If you can map sound to qwerty keystroke placement, then it’s a simple matter of mono alphabetic substitution for other layouts to generate candidate texts. Using a dictionary attack to find more candidate layouts would absolutely work.
No, all the timings change. You can’t just swap out the letters and hope it matches. Additionally I was responding to the poster claiming a dictionary attack on a password would work - only if it’s in the dictionary.
The method is not based on timings. It is based on identifying the unique sound profile of each keystroke
How can you make that claim? They used deep learning, does anyone know what characteristics the AI is using?
Dvorak?
Middle management will finally get rid of clacky keyboards with this weird trick
Good luck making an acoustic map of the tens thousands of possible case, switch and key cap combinations.
Not to be a jerk, but is this actually new? I’ve heard of this being done at least ten years ago…
On another note, one way to beat this (to a degree) would be to use an alternate keyboard like Dvorak (though you could probably code it to be able to detect that based on what’s being typed)
I think it’s largely been a state actor thing. Directional microphone to record your window from across the street, spend significant tax money on crunching numbers on a supercomputer to get at your password kind of thing, I think they already could do it in the 90s. Real-time 95% accuracy on a non-specialised device is a quite different ballpark: Now every skiddie can do it.
Now every skiddie can do it.
And this is the real, serious problem. Most people are pretty unlikely to stop a state sponsored spy operation no matter how careful they are. It’s barely worth worrying about unless you know for a fact you’re being tapped and that you will be killed about it, and even if you do know this the state can pull some space age bullshit out of their asses that doesn’t yet have a counter. Top secret military industrial research goes into maintaining that exact advantage every year, if they really want to get you, you will get got. But if Joey Dickbeater and his school friends can just point a mic at your window and then upload it to the Pass-o-Gram to decode it, you have a real problem. It’s like when TikTok kids figured out they can steal Kias with usb keys - if every teenager in America knows how to steal your car, its lifetime is going to be measured in minutes. Same with passwords.
Sounds like it’s time to buy a bunch of random cherry switches and randomize them across my keyboard…
Sounds like it’s time to buy a bunch of random cherry switches and randomize them across my keyboard…
And rotate them. While I don’t plan to waste my energy, having hot swap sockets and swapping a few around should thwart the attack. You would have to do it frequently enough that relevant training data gets wasted before it’s useful. I’m pretty paranoid, but not that much.
I’ll just consider it good security hygiene to get a new keyboard often :)
Have you considered only re-doing the tinfoil wrapper every day? It should crackle differently every time.
What it means is that NIST probably needs to update its security recommendations to require hardware keys for even low level systems. It’s going to be a huge pain in the ass though.
Gotcha, that makes more sense
Coding for alternate key mappings is almost as trivial as detecting other languages.
Yeah, that’s what I figured
It’s more trivial because it’s a 1:1 relationship. A is a, s is o, d is e, and so on. Detecting other languages is harder because there’s more of them and there isn’t a 1:1 conversation to English.
There has been previous work on this, yes. It required a dictionary of suggested words. That would make it useful for snooping most typing, but not for randomly generated passwords. This new technique doesn’t seem to have that limitation.
Okay, gotcha. I didn’t look that deeply into it previously so I never realized how limited that was
So about those people that run around saying passphrases are better… 😅
I think I might have achieved security through obscurity. My custom keyboard is a unique shape and almost all the keys are one unit. Not only is it different enough from a traditional keyboard that the neural network probably won’t understand it, the function layers I use obscure whether I’m typing a letter at all.
Does that come with free fingerless gloves?
No, but it comes with your choice of flavoured frozen yoghurt.
That’s good!
The yogurt contains potasium benzoate
That’d bad
Removed by mod
Of course not. The fingerless gloves are also niche, boutique, and premium.
I have a headache just looking at that.
What keyboard is it, corne? I have to admit that your keycaps are incredibly cursed, how you have mixed caps from different layers
It’s a chocofi.
CTGAP on the base layer, and 6 layers on top of it, using a heavily modified version of Miryoku.
Most of the keycaps are correct, just for different layers. It helps prevent key peeking, plus I like the cursed aesthetic.
that’s a surprisingly cheap keyboard. I ended up ordering a zsa voyager a couple days ago because I wanted keys, but I couldn’t find any prebuilt split keyboards that had a base configuration below like $350. I might end up going with cursed keys on mine, it looks pretty cool
This is why I always make sure there are no boffins around before I start typing.
If there are boffins around, I start typing out the GDPR guidelines in full
What about Hornblower’s, Bolger’s, Took’s, Sackville’s or Grubb’s?
I wonder if you need to train it on a specific keyboard before it will work it.
Most likely
That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.
I also notice that I slightly change my typing style between typing normally and entering my password.
That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.
Eh… I don’t know if it would be enough of a change. Also consider mass produced popular laptops (e.g. targeting the MacBook keyboard).
I also notice that I slightly change my typing style between typing normally and entering my password.
I don’t really think that’s normal… But hey, maybe it gives you some protection 🙂
I doubt so. Wouldn’t Zipf’s law be used for this?
deleted by creator
Can we normalise good but quiet keyboards. Like, I like the tactile feel of using a mechanical, but I hate the sound. Quieter mechanical keyboards aren’t a thing but they should be. Now as a security measure if nothing else.
Also Dvorak keyboards I guess
There are tons of quiet mechanical keyboards. I’m using a low profile optical switch that’s quieter than my mouse clicks
Are those optical switches expensive though?
No
There are definitely quiet tactile switches. The reason why they can still make sound is because they’re bottoming out which you don’t have to do.
As a partial solution, you can put o-rings in the keycaps. I had some of the bands for braces laying around at one point and used those, and it worked fairly well.
Dvorak is a cypher of Qwerty tho. Anything typed in Dvorak but transcribed as english can be reliably identified and decyphered
I went out of my way to find a keyboard with Cherry MX Clear switches. They’re basically a high-force tactile feel, but no clicky sound like MX Blue switches. I absolutely love them for typing, and I’ve been using them for years.
I’m not sure if there’s newer options now for silent switches? I know they had a couple models with extra internal damping.
I used boba u4 silents on my custom keyboard. Absolutely love them. Wish they made a consumer-grade keyboard with them (or maybe they already do?) But I’ve been working on a MacBook recently and tbh the keyboard there is pretty good now. So next step for me is to build a low profile keyboard
normalise good but quiet keyboards
Oh man, if Topre became popular enough to bring the price down through scale that would be pretty rad
Dvorak
vi tho.
On my colemak keyboard I put arrow keys on another layer under where hjkl are on qwerty. Beyond that, most of the keys are remembered by mnemonic rather than position imo
That awkward moment when you use Nano
Up against the wall
I always uninstall nano the first time it shows itself
I guess my typos are now a security feature!
I’d be curious how well this approach translates to multi-lingual keyboard layouts. For english users, perhaps theres another benefit to non-QWERTY layouts (e.g. Colemak or Dvorak) after all? … and two factor authentication should remain helpful I presume. Especially physical key methods with no audible characters typed (e.g. Yubikey, Titan, etc.)
I was thinking the same, but it would be trivial for software to realize that “fnj xlg” maps to “the dog” with Colemak or Dvorak.
How good does this work if there’s other noise pollution? Like music playing etc?
Is it ignorance, indemnity, or conspiracy that this News Media Corporation didn’t give the primary mitigation?
A white noise generator.
Some laptops like the Framework laptop have fingerprint sensors
Physical Security keys like NitroKeys or YubiKeys are another option
I don’t see the relevance.
You can use fingerprint or U2F to unlock your password manager and copy the password. That way you don’t have to type it in.
Another advantage to the split keyboard
This attack is useless in the real world.
That said, what gives you the idea a split keyboard (if they had a sample of you typing on it etc) would be any different than a normal one?
It is just another keyboard with a different sound profile.
You can remap and customise keys to be whatever you want. There’s even auto shift, so if I hold certain key just a bit longer than a regular tap, it will automatically capitalise or whatever the shift + key combo would result in. There are also multiple layers you can easily activate with a press of a button, so the layout is something totally different.
Example: https://configure.zsa.io/moonlander/layouts/default/latest/0/
deleted by creator
It was just a joke
Isn’t boffin a derogatory term like “nerd”?
What a dogshit headline.
Article also uses the term “eggheads”.
To go from keystroke sounds to actual letters, the eggheads recorded a person typing on a 16-inch 2021 MacBook Pro using a phone placed 17cm away and processed the sounds to get signatures of the keystrokes.
Maybe a US/UK divide? At least in the UK boffin is relatively inoffensive depending on how it’s used. Eg if I build a fusion reactor in my garden my neighbour might say “wow, look at what this boffin did!” and it would be a complement where boffin is a stand in for a word like genius, only with a tounge in cheek touch of jealousy.
Thinking about it I would say that ‘nerd’ is typically putting someone down for their intelligence or interests, whereas boffin is a light insult while identifying the ‘boffin’ as being smarter than yourself.
It can be. Being a boffin, I’m not offended. Up to the individual if they choose to be offended.
Still shitty journalism to refer to researchers publishing their research in that way.
Meh, I wear such labels as badges of honor. I sacrificed a bit along the way to develop knowledge, skills, competence - I’ve earned it. Thanks for acknowledging it.
I also see such things in a humorous light. I mean us “boffins” can be such boffins at times. We can over-focus, get caught up on perfectionism, etc, etc. If’n ya can’t laugh at your own foibles, well, I don’t know what to say.
