FYI it was very little effort. You can do it too! I followed two links to the paper, looked for "how did they test this thing" (because I was skeptical about that bit), then skimmed the three paragraphs in section 4 "Feasibility Study". I'm hoping that people that care more than I do will read more.
Sure, a positive interaction and rewarding something important. At the same time we shouldn’t forget to aim to make this behavior commonplace.
They have a section on the filtering they needed on the real world audio to extract the information they needed.
The conclusion even states “ We evaluate SpiKey with a proof-of-concept simulation, based on real-world acoustic data, and demonstrate that SpiKey can reduce the search space from a pool of more than 330 thousand keys to just three candidate keys for the most frequent case.”
Why do you claim it’s not real audio?
You could still be right. I've been reading again, and I'm having a hard time telling apart statements about how their tool works in general, vs. statements of a particular test of it.
If they actually tested this thing end-to-end, I would expect to be able to answer (i) how many actual key recordings did they test it on?, and (ii) did it work? Was the actual key found among the 3 (or however many) candidates?
The image attack offers way more opportunities there, as you just need to be able to see the key (as opposed to the hypothetical sound attack, which requires that you capture the sound of the lock being unlocked).
As an aside, If you're keen to learn more about locks and security, I suggest having a look at LockPickingLawyer on YouTube[2].
[1] https://www.youtube.com/watch?v=AayXf5aRFTI [2] https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
They link the actual recording in section 3.1: http://bit.ly/2JciYB6
What they are saying is to find their target keys, they physically modelled 330,424 candidate keys, generated an acoustic simulation and then ran the acoustic simulation of clicks though the tool described in sections 3.1 to 3.6. They used the insertion speed of 1 inch per second for this physical simulation of candidate keys.
Then they compared the output of the tool on all the candidates to the output from the original real recording to see which ones lined up the best.
What I'm confused about is, I would expect them to say that they ran that recording through SpiKey, and it output 3 (or however many) candidates, and the actual key was (or wasn't) one of the three. But instead, that bit.ly link is provided for "better understanding", and the rest of the section it's in is about the tool in general, rather than a specific test of it.
Was it one actual recording they tested, you think? Do they say whether the actual key was among the candidates?
Pretty shady if so...
They did not take a recording of an actual key in an actual lock and determine the shape of the key. Instead they simulated the sound of a key in a lock, and determined the shape of the key from that simulated sound. And the simulation assumed that the speed that the key moves at is fixed as it enters the lock, at 1 inch per second.
So this article is false. It wouldn't have been that hard to read the paper, and say what they actually did. It bothers me that articles like this don't, and instead run with an exaggeration.
EDIT: As far as I can tell from the paper, at least. What on earth is a "simulation, based on real-world recordings"? I don't see anything about an actual recording in section 4.