Key clicks betray passwords

Gareth · 19-09-2005, 13:39

Just read this interesting article over at SecurityFocus, that explains how using a $10 microphone, researchers have found that a 10-minute recording of a person typing at the keyboard reveals enough information for a computer analysis to recover nearly 90 percent of the words entered.

source: http://www.securityfocus.com/news/11318

Millay · 19-09-2005, 13:42

Is this not the reason that with online banking and the such like that we now have pull down lists to go though as an added lev3el of security...

Gareth · 19-09-2005, 13:44

Kinda... we use it to stop keyloggers (of the software variety), but it should also stop eavesdroppers too as a mouse click when selecting one character sounds the same as a mouseclick selecting any other character

Of course, if the user uses a keyboard shortcut to access the character in a dropdown list, then it defeats the whole point.

Aragorn · 19-09-2005, 13:46

Sounds like a good argument in favour of two factor authentication - eg smart-card with pin number.

SMHarman · 19-09-2005, 13:50

Quote:

Originally Posted by Gareth

Kinda... we use it to stop keyloggers (of the software variety), but it should also stop eavesdroppers too as a mouse click when selecting one character sounds the same as a mouseclick selecting any other character

Of course, if the user uses a keyboard shortcut to access the character in a dropdown list, then it defeats the whole point.

The Tab arrow dn dn dn dn dn dn tab dn dn dn tab etc approach. I do that.

19-09-2005, 20:04

Ya may notice someone stood behind you with a microphone recording your key taps.

Seriously though, I'd imagine it works on qwerty style keyboards, but imagine all the potential errors if the user was using say a language specific keyboard or something?
And what about keyboard covered in a rubber membrane?

LemonyBrainAid · 19-09-2005, 20:37

My space bar sounds different to Nemmy's, so you'd have to know the keyboard properly first, I reckon'

nffc · 19-09-2005, 22:17

Quote:

Originally Posted by LemonyBrainAid

My space bar sounds different to Nemmy's, so you'd have to know the keyboard properly first, I reckon'

Think it works on inverse square law and positioning. As you increase the distance between a sound source or even a wave source the intensity decreases exponentially.

Placing a microphone in a known place and measuring sound intensity, plus a tad of algebraic manipulation, can *easily* determine which keys are pressed. The intensity is the key to the distance away and by putting it in a certain position, the direction factor is minimised so they can guess the keypress order.

It's nothing to do with how the KB sounds.

LemonyBrainAid · 19-09-2005, 22:30

Oh, great, I understand fully now :P :P

nffc · 19-09-2005, 22:57

Quote:

Originally Posted by LemonyBrainAid

Oh, great, I understand fully now :P :P

Was that sarcastic?