The Security Risk of Keyboard Clicks

Gudlyf writes "First the blinking LED security issue, now this: listening to tell-tale keyboard clicks to decipher from afar what a person is typing. This isn't limited to just computer keyboards -- ATM's, telephone keypads, security doors, etc. Apparently with $200 worth of sound equipment and software, these keyboard clicks can be translated to within 80% accuracy. Of course, a whole lot of this is just theory."

Great...

[ebob9]

Now when I log in to my account at work, instead of just needing password, secureid, smartcard, fingerscan, eyescan, and a note from my mother, I'll also need to use an on-screen touch-screen keyboard!

Of course, someone will probably now figure out that tapped glass reverberates at a different frequency...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Great

[MrRuslan]

Pretty soon they will find a way to desipher hidded messeges from human and animal farts.

LED clock

[donnyspi]

I can't even tell what freakin time it is on my LED clock from ThinkGeek, much less deciper keyboard clicks and modem blinks :-)

This is easy to overcome

[JosKarith]

Al you have to do is install voice-recognition software, then train it to only understand you when you speak in a broad Glaswegian accent.
Thereby ensuring NOBODY's going to be able to decipher a word you're saying.

Re:low~

[Anonymous Coward]

More hits == increased ePenis size!

Re:Great...

[orangesquid]

True. But you could also read the screen via Tempest-like technology!

It seems that no matter what you do, we'll be screwed anyway. We might as well go to a trust-based system. How about everybody just changes all their passwords to 'secret'?

Comment removed

[account_deleted]

Comment removed based on user account deletion

will never break my password

[GarbanzoBean]

I don't type my passwords. I use voice recognition software and just say them. No clicks to overhear baby!!!

Doh

Re:Great...

[MadBiologist]

Darn.... now I'm gonna have to change my password.

First somebody gives away the 12345, now secret.

Sheesh.. What's this world coming too?

-J-

Future - Speech Recognition

[jabex]

Good thing the whole future of "speech recognition" didn't pan out. Oh those silly Star Trek episodes, everyone can hear when Picard announces his secret password to everyone!

In other news:

[Big Nothing]

In other news: hackers can connect to the internet by whistling into the phone.

Re:Security risks

[the_mad_poster]

Anywho, my girlfriend just yelled at me so I needed to vent.

Huh? Quit making up words!

No worries.

[Chess_the_cat]

Today's keyboard, telephone keypads, ATM machines and even door locks have a rubber membrane underneath the keys.

My Model M doesn't have a rubber membrane so I'm not worried. Then again you don't need a microphone to hear me typing on it. My neighbours can hear me typing. If someone were to stick a microphone up to it I'd be interested to know how much of their hearing they'd retain.

Re:Covering noise

[madman101]

Nah, just a boom box with volume on 11 playing Spinal Tap.

Re:Great...

[evil-osm]

or you can just look for the smudge marks...

Re:Great...

[steveb964]

...yeah, great!

Now everyone will be able to know that I'm typing slashdot.org in my browser at work!!

Sheesh, if this is true, I may actually have to do something!!

I should have saved my Atari 400

[zymurgy_cat]

Now I know that I should have saved my Atari 400. With that flat quiet keyboard, no one would be able to snoop on my typing. Of course, I'd have carpal tunnel so bad I couldn't pick up a spoon...

Re:Hmmm

[alib001]

It's only a matter of time before they interpret the crinkling noises made by our protective hats and are able to read our very thoughts!

Re:Great...

[los furtive]

12345? That's the combination on my luggage!

Ah Spaceballs, what would we do without you?

Who needs a machine when we've got the Mounties!?!

[Rahga]

"Apparently with $200 worth of sound equipment and software, these keyboard clicks can be translated to within 80% accuracy. Of course, a whole lot of this is just theory."

Anybody who saw the episode of the CBS evening buddy-cop-drama "Due South: A Hawk and a Handsaw" [realduesouth.com] knows that you don't need any special equipment. Just get a Canadian Mountie, have him listen to a nurse while she types in her password, and after several tries, the Mountie will be able to reproduce the password based solely on the sound of the clicks... Results are even better if the password is typed in to the tune of "I've been working on the railroad.".

Re:Great...

[Opie812]

Nah. Think about it: pressing different spots of your screen is like pressing down a guitar string at different points. You will cause the screen to resonate with a multitude of frequencies with distinct audio "fingerprints" for different points on the screen, which can also be picked up by very sensitive equipment.

Sorry.

Personally, I'd just look at where the smudges are on the screen and go from there, but I'm not no uber-Linux guy or anything. :)

In theory...

[pbryan]

Of course, a whole lot of this is just theory.

Of course, in theory:

- the earth is spherical in shape
- the earth revolves around the sun
- we evolved from lower species
- energy equals mass times the speed of light squared

easy fix.

[dj245]

what, you guys don't use a binary keyboard? 99 less keys to break.

that guy needs a better hobby

[jimmajamma]

i mean, if someone wants to spy on your keystrokes they could install one of those $20 keycatcher thingies, freeware keyboard capture software, network snifers, or just look over your shoulder.

what kind of idiot would use a mic, and have to use neural nets to analyze the recording?

i wonder how many hours that guy flushed doing this study.

it would have been arguably more useful if he could determine what someone ate the night before by the sound of the splash.

Re:"Of course, a whole lot of this is just theory.

[AnonymousKev]

From an old (and eccentric) college Physics prof:

The difference between theory and practice is, in theory, there is no difference between theory and practice, but in practice, there is.

Re:Covering noise

[NanoGator]

"Now we just need some covering noise while logging in. Time for a kernel patch? "

Are you trying to tell me I won't be secure until I get sound working in KDE? Crap.

Oh, it hurts...

[amstrad]

smartcard with a PIN number

somewhere a kitten just died.

Re:Great...

[Don'tTreadOnMe]

Exactly !

"The first rule of ATM security is: there is no ATM security".

"The second rule of ATM security is that we talk alot about ATM security."

"The third rule of ATM security is that at some point someone will mis-quote a movie."

Re:my bank's ATM's and Internet smart keyboards

[Kent Recal]

Yes, I've seen a simplified design.

[ 3 or 7 or 9 or 6 or 0] [ 5 or 1 or 2 or 0 or 8 or 4 ] [ I'm feeling lucky! ]

Whew thats a relief

[Tandoori Haggis]

Its just as well I use my mouse to click on porn.....