Congress apparently doesn't use CACs, and the photo shown of the desktop shows no card reader to stick a card in.

The idea that a senior US Congressperson or Senator would have the same rules as some IT contractor is ludicrous.

Her password is probably password123 or some such nonsense too.

Security problems that begin with "the user had a weak password" are strictly the fault of IT nowadays. Every application and gateway should check password complexity and reject passwords on the top 1000 list. If password123 is allowed the IT director should be fired.

Password rejection rules are the primary cause of sticky notes with passwords under the keyboard/on the screen - and they are phishable, loggable, videoable and can be deduced from the keyboard click sounds.

2FA / 3FA is a minimum these days (and can be easier to use than a password)

Keyboard click sounds? I'm gonna need to see some kind of something for that. Sorry, it just sounds like something out of Eagle Eye, like that cup of coffee in that secure room the computer reads the waves on.

It's not a new threat. https://www.berkeley.edu/news/media/releases/2005/09/14_key.... is 16 years old.

Standard rules for (Soviet) embassy staff during the cold war included writing secret documents with a pencil rather than a typewriter because the text might be deducible from the sound of the typing.

Of course the writing would also be done in a box suspended inside another room with white noise generators in the intermediate space, just in case the text might also be deducible from the sound of handwriting.

My source for that might be one of Viktor Suvorov's books.

Relevant Picture (from since deleted tweet - Interesting that the media is still accessible on twitter...)

https://pbs.twimg.com/media/ErErUqKXMAMQtyy.jpg

I _believe_ this is where that picture originated from https://twitter.com/mikko/status/1346922681158000640?s=21

It almost looks like a photo that an employee themselves might take after being shown such an alert message.