News for hackers. Stuff that matters.
Re:New acoustic attack steals data from keystrokes with 95% ... by glitchc on Saturday August 05, 2023 @04:05PM (#37015820)
Brilliant suggestion. Have a TRNG or a CSPRNG (if too poor for a TRNG) choose the next layout at random for you, ideally with every keystroke. Good luck cracking that!
Re:New acoustic attack steals data from keystrokes with 95% ... by mdp2021 on Saturday August 05, 2023 @04:24PM (#37015970)
Could be done by using a device with a display - e.g. an "ereader" - to present a random keyboard layout. But, good luck being efficient typing on that. At that point, better use a different input model.

Or, use techniques such as those in the article, such as random keypresses played during the actual ones.

Re:New acoustic attack steals data from keystrokes with 95% ... by FireBeyond on Saturday August 05, 2023 @11:35PM (#37018757)
Some banks went through a phase of this - website would present an on screen keyboard for the password field with a randomized layout.

I'm sure customer frustration was huge.

Re:New acoustic attack steals data from keystrokes with 95% ... by segfaultbuserr on Saturday August 05, 2023 @04:23PM (#37015968)
Some places use touchscreen keypads for PIN entry exactly for this reason, e.g. for opening a locked door, or for authorizing a transaction.
Re:New acoustic attack steals data from keystrokes with 95% ... by bee_rider on Saturday August 05, 2023 @04:45PM (#37016133)
That is interesting.

I’m sure it depends on the application to some extent. I can type my pin in without looking at all, so I can cover it up while doing it. If I had to hunt and peck, it’d easier for an onlooker to observe my slower motions I think.

But if I used the same machine often enough to produce wear specific to me, this randomization would be really useful.

Re:New acoustic attack steals data from keystrokes with 95% ... by zootboy on Saturday August 05, 2023 @06:50PM (#37017007)
I use a randomized PIN pad on my phone, and I've gotten quite used to it. I can enter my PIN almost as fast as I could on an unscrambled pad; it's definitely not hunting and pecking.
Re:New acoustic attack steals data from keystrokes with 95% ... by 8note on Saturday August 05, 2023 @04:58PM (#37016227)
Do they randomize the key locations though?

Otherwise, you leave behind grease where your fingers touched

Re:New acoustic attack steals data from keystrokes with 95% ... by segfaultbuserr on Saturday August 05, 2023 @05:21PM (#37016420)
Yes, the layout is randomized every time you use it.
Re:New acoustic attack steals data from keystrokes with 95% ... by hoosieree on Saturday August 05, 2023 @04:23PM (#37015962)
Even using Vim or Emacs would add some obufsCTRL[dbiobfuscation from all the spurious keystrokes.