News for hackers. Stuff that matters.
Re:The way people tilt their smartphone 'can give away passw... by kinkora on Tuesday April 11, 2017 @10:39AM (#14088200)
Interestingly novel!

In my university days, long before the days of tablets and smartphones, the computer labs were the usual place where people will congregate to do their assignments or basically kill time on the internet in between classes.

One day, my mates and I noticed how annoyingly loud some people type on their keyboards and out of sheer boredom, we decided we could come up with an algorithm to determine what a person was typing simply from recording the sound of the keystrokes from our vantage point. Taking that sound clip, we graphed it out and we proceeded to hash out each "stroke" based on how loud it was in relation to the distance of where we were from the keyboard + the angle of the keyboard.

Fun times ensued. ;)

Re:The way people tilt their smartphone 'can give away passw... by programd on Tuesday April 11, 2017 @01:18PM (#14090192)
I think it was in the book Spycatcher [0] that I recall there was a story of how English intelligence bugged a foreign embassy with a microphone and was able to figure out what they were typing on a typewriter by analyzing the sound of the keystrokes. That was way back in the 1950's I think, so the idea has been around for a while. The book has a lot of interesting details about spy technology at the time. In addition to all the juicy intelligence stories it's also a fun read from a security engineering point of view. The British government tried to ban it which naturally triggered the Streisand effect and made it a best seller.

[0] https://en.wikipedia.org/wiki/Spycatcher

Re:The way people tilt their smartphone 'can give away passw... by user5994461 on Tuesday April 11, 2017 @11:35AM (#14088914)
There is a paper from one of the guys who made RSA about that.

They can reconstitute private keys, by listening repeatedly to the sound the power supply of a laptop makes when encrypting/decrypting emails, from 5m away.

Re:The way people tilt their smartphone 'can give away passw... by enraged_camel on Tuesday April 11, 2017 @06:50PM (#14093220)
This type of thing is called a side-channel attack, if you're interested.

https://en.wikipedia.org/wiki/Side-channel_attack

Re:The way people tilt their smartphone 'can give away passw... by Shivetya on Tuesday April 11, 2017 @12:10PM (#14089456)
the good old days in the military where our main communications computers and such were in shielded areas to prevent leakage outside which could be picked up.
Re:The way people tilt their smartphone 'can give away passw... by Neliquat on Wednesday April 12, 2017 @09:07AM (#14097241)
Tempest certification is still very much alive and well fyi.
Re:The way people tilt their smartphone 'can give away passw... by evincarofautumn on Tuesday April 11, 2017 @04:06PM (#14091942)
That reminds me—in elementary school, I used to figure out what someone was writing by listening to the sound of their pencil, sometimes by putting my head to the desk. It probably worked mainly because they were writing pretty slowly in large print, but I imagine you could come up with a software implementation as a useless gimmick if you had enough training data.

I’ve considered implementing this as a keyboard layout in Android, so you could put your phone on the desk and type by scratching a stylus or fingernail on the surface next to it.

Re:The way people tilt their smartphone 'can give away passw... by kakarot on Tuesday April 11, 2017 @02:52PM (#14091203)
Acoustic analysis of keystrokes is nothing new to most of us.

Some of us are even familiar with acoustic cryptoanalysis[0].

However, combine these methods with this[1] tech, inspired on the work done here[2], and we have ourselves an impending crisis on our hands.

[0] Acoustic Cryptoanalysis - https://courses.csail.mit.edu/6.857/2014/files/23-shroff-hu-...

[1] Extracting Audio From Visual Information - https://news.mit.edu/2014/algorithm-recovers-speech-from-vib...

[2] Eularian Video Magnification - https://people.csail.mit.edu/mrub/papers/vidmag.pdf

Let's run through a scenario.

Your office orders pizza every Tuesday at the same time, via a coworker's cell phone. You are working on a technology that has the potential to disrupt several leading industries that are in bed with the government. After much lobbying, it is decided one day that your call to Domino's is to be rerouted via your broadband processor to an operative that mirrors your order to the real Domino's, and hand delivers the pizza at the front desk.

On their way out, they place a small, embedded, self-destructable camera device that focuses on your fancy new plexiglass installment. Over the next few weeks, the device documents all keystrokes and conversations from the front desk, and finds a way to socially engineer a copy of your codebase. Next year, seemingly out of nowhere, another venture suddenly launches ahead of your launch schedule, with your exact business model. All because you wanted some plexiglass and didn't think it was worth the money to actively scan the entire perimeter for bugs daily.

If this sounds crazy and far-fetched to anyone, then it would behoove them to look into past CIA infiltration techniques and also to realize that this is exactly the kind of stuff the CIA exists to do.

Re:The way people tilt their smartphone 'can give away passw... by NoCoastCoder on Tuesday April 11, 2017 @11:25AM (#14088774)
And this worked? Seems hard to believe.
Re:The way people tilt their smartphone 'can give away passw... by cmdrfred on Tuesday April 11, 2017 @11:35AM (#14088912)
It would cut entropy down by a great deal if you even simply knew how long the password was.
Re:The way people tilt their smartphone 'can give away passw... by wruza on Tuesday April 11, 2017 @12:19PM (#14089567)
I've seen a movie where a bad guy entered password and a good girl counted the number of characters: one-two-three-four-five. Then she noticed that his suit had "GREED" badge on it. Combining these two facts she succesfully hacked into his laptop and prevented some shit. Since then I started to always mix few backspaces into my passwords. Not that I'm really bad, but life is life.
Re:The way people tilt their smartphone 'can give away passw... by ballenf on Tuesday April 11, 2017 @02:39PM (#14091069)
The backspace key on most keyboards has a very distinct sound. Not to mention it's positioning means timing will be noticeably different as well. Might be better off mixing in a few meaningless modifier keys (press Ctrl, Alt or Caps Lock).
Re:The way people tilt their smartphone 'can give away passw... by sigjuice on Tuesday April 11, 2017 @03:01PM (#14091282)
I usually type a long string of gibberish, sneak in ctrl-U at some point and then enter my actual password
Re:The way people tilt their smartphone 'can give away passw... by idanoeman on Tuesday April 11, 2017 @04:02PM (#14091892)
Unless the gibberish is the same every time, the repeated sound of your password will still be parsable from a long enough sound recording of your computer usage.
Re:The way people tilt their smartphone 'can give away passw... by sigjuice on Tuesday April 11, 2017 @05:05PM (#14092432)
The gibberish is unlikely to ever be the same.
Re:The way people tilt their smartphone 'can give away passw... by jaredsohn on Tuesday April 11, 2017 @06:03PM (#14092924)
I think it is more accurate to say that the gibberish is unlikely to _always_ be the same.

I think one can tend to create similar gibberish over time. I've worked on a system where I needed to do a new signup every time I wanted to test a feature and I've run into issues where the gibberish I entered matched an account that I had previously created.

Re:The way people tilt their smartphone 'can give away passw... by NeutronBoy on Tuesday April 11, 2017 @07:13PM (#14093343)
Everyone here has accounts in development databases named 'aaa', 'asd', 'asdf', 'qwer', 'hjkl', etc!
Re:The way people tilt their smartphone 'can give away passw... by BigJono on Tuesday April 11, 2017 @07:43PM (#14093514)
Nope, mine are all oeunt, oeunth, huet, uehis, ais, etc
Re:The way people tilt their smartphone 'can give away passw... by uiri on Tuesday April 11, 2017 @09:31PM (#14094070)
You are a user of the Dvorak layout, I take it? Colemak seems like it would have a different fingerprint.
Re:The way people tilt their smartphone 'can give away passw... by BigJono on Wednesday April 12, 2017 @05:25AM (#14096067)
Yep! Always a bit of fun when someone goes to use my laptop for an end-of-sprint presentation and types a bunch of gibberish infront of all the stakeholders :D
Re:The way people tilt their smartphone 'can give away passw... by PhasmaFelis on Tuesday April 11, 2017 @03:04PM (#14091309)
I feel like the real lesson here is "don't wear your password."
Re:The way people tilt their smartphone 'can give away passw... by SamReidHughes on Tuesday April 11, 2017 @01:36PM (#14090427)
Barely. Trying all the passwords less than N characters long is way cheaper than trying the ones that are exactly N.
Re:The way people tilt their smartphone 'can give away passw... by cmdrfred on Tuesday April 11, 2017 @02:04PM (#14090741)
Best case scenario wouldn't you have to do both without knowing the length?
Re:The way people tilt their smartphone 'can give away passw... by thfuran on Tuesday April 11, 2017 @02:29PM (#14090983)
Right but even with alphanumeric only, only about 2% of passwords of length N or less are less than length N.
Re:The way people tilt their smartphone 'can give away passw... by baddox on Tuesday April 11, 2017 @03:03PM (#14091297)
The advantage is having the upper bound.
Re:The way people tilt their smartphone 'can give away passw... by nerdponx on Tuesday April 11, 2017 @11:32AM (#14088867)
I think I read about a similar "keylogging" technique in Popular Science at one point.
Re:The way people tilt their smartphone 'can give away passw... by trendia on Tuesday April 11, 2017 @11:58AM (#14089287)
Researchers recover typed text using audio recording of keystrokes (2005) [0]

[0] http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...

Re:The way people tilt their smartphone 'can give away passw... by purrcat259 on Tuesday April 11, 2017 @12:27PM (#14089652)
Turns out my ducky blues mechanocal keyboard has a big disadvantage when it comes to this then
Re:The way people tilt their smartphone 'can give away passw... by scoot on Wednesday April 12, 2017 @08:29AM (#14096949)
No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the ride.
Re:The way people tilt their smartphone 'can give away passw... by scoot on Wednesday April 12, 2017 @08:27AM (#14096938)
No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the rise.
Re:The way people tilt their smartphone 'can give away passw... by ww520 on Tuesday April 11, 2017 @02:00PM (#14090705)
The good old side channel attack. Kudos.