New policy from the corporate office: If you are working in a public place, like a coffee shop, please scream while typing your login password.
this post was submitted on 02 Dec 2023
399 points (95.2% liked)
Technology
58070 readers
3251 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
I screamed my password and now I got hacked. Thanks for nothing!
use the onscreen keyboard
much more secure
why won't my bank stop calling me
Quite scary considering the accuracy and how many open mics everyone is surrounded by without even realizing it. Not to mention if any content creator types their password while live streaming or recording they could get their accounts stolen.
One more reason to switch to a password manager, even though they could still find out the master password…
Probably still have some safety if you're using two-factor, or have a master key in addition to a password (e.g. 1Password).
Only if you have to type it in to unlock your vault. Now, bear with me.
Bitwarden (maybe others) lets you set a PIN to unlock your vault. Normally, you would think this is a less secure setup, easier to crack with the method outlined in this article. Except with Bitwarden you have to set up the pin in every browser extension and every app install.
Meaning, unless they have access to your device, the PIN to unlock one instance of Bitwarden could be different from the PIN for another. They also don't have to be strictly 4-digit PINs, either. I highly recommend password managers, but for my money, Bitwarden has all my love.
Disclaimer: I am on no way affiliated with Bitwarden. But I could be if they paid me!
load more comments
(2 replies)
load more comments
(3 replies)
This has been a known attack vector for years, and I wonder how no livestreamer has been (publicly) attacked in this way.
I guess in large part this can be attributed to 2FA, passwords just aren't worth much by themselves anymore (well I guess if someone is quick enough they can snipe the OTP as well, but streamers are rarely entering their 2FA while streaming since they're on a trusted device).
In fact the biggest attack vector I'd worry about is the infamous SMS 2FA, which is actually 1FA for password resets, which is actually 0FA "yes dear phone operator I am indeed Mister Beast please move my phone number to this new SIM".
Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.
I'll accept the risk. I need the clicky
load more comments
(2 replies)
This is why I always make sure there are no boffins around before I start typing.
If there are boffins around, I start typing out the GDPR guidelines in full
load more comments
(1 replies)
Not to be a jerk, but is this actually new? I've heard of this being done at least ten years ago...
On another note, one way to beat this (to a degree) would be to use an alternate keyboard like Dvorak (though you could probably code it to be able to detect that based on what's being typed)
I think it's largely been a state actor thing. Directional microphone to record your window from across the street, spend significant tax money on crunching numbers on a supercomputer to get at your password kind of thing, I think they already could do it in the 90s. Real-time 95% accuracy on a non-specialised device is a quite different ballpark: Now every skiddie can do it.
load more comments
(5 replies)
Coding for alternate key mappings is almost as trivial as detecting other languages.
Yeah, that's what I figured
load more comments
(1 replies)
There has been previous work on this, yes. It required a dictionary of suggested words. That would make it useful for snooping most typing, but not for randomly generated passwords. This new technique doesn't seem to have that limitation.
load more comments
(2 replies)
I guess my typos are now a security feature!
I'd be curious how well this approach translates to multi-lingual keyboard layouts. For english users, perhaps theres another benefit to non-QWERTY layouts (e.g. Colemak or Dvorak) after all? ... and two factor authentication should remain helpful I presume. Especially physical key methods with no audible characters typed (e.g. Yubikey, Titan, etc.)
I was thinking the same, but it would be trivial for software to realize that “fnj xlg” maps to “the dog” with Colemak or Dvorak.
I wonder if you need to train it on a specific keyboard before it will work it.
Most likely
That would limit the practicallity quite a lot, as deskmats and typing style would change the sound of even a common keyboard.
I also notice that I slightly change my typing style between typing normally and entering my password.
load more comments
(1 replies)
load more comments
(2 replies)
Some laptops like the Framework laptop have fingerprint sensors
Physical Security keys like NitroKeys or YubiKeys are another option
I don't see the relevance.
You can use fingerprint or U2F to unlock your password manager and copy the password. That way you don't have to type it in.
load more comments
(3 replies)
Can we normalise good but quiet keyboards. Like, I like the tactile feel of using a mechanical, but I hate the sound. Quieter mechanical keyboards aren't a thing but they should be. Now as a security measure if nothing else.
Also Dvorak keyboards I guess
load more comments
(8 replies)
I never learned to touch-type, so my typing style is very different from most people though I can type fast enough for work.
My typing style only uses 3 fingers, and both hands type keys in the middle of the keyboard.
I wonder if this has any effect on accuracy?
Edit: Article states touch-typing can reduce accuracy. Wonder if that's because they type more softly than us tech gorillas who tend to bash on the keys?
I'm a touch typist who can reach 160wpm when I'm really flowing, I would guess the speed makes accuracy harder to distinguish individual keys than you pressing keys with three fingers.
I type an awful lot slower than you, and still it's faster than I can think. How do you think of what to type fast enough to type at 160wpm?
Not the original person you responded to, but I type 120ish wpm. The trick is to try to tap into the same part of your brain that verbalizes words when you talk, rather than the part that composes stuff when you write.
load more comments
(2 replies)
load more comments
(2 replies)
I wonder if different switches, keycap profiles, keyboard material ect affect the accuracy?
Is it ignorance, indemnity, or conspiracy that this News Media Corporation didn't give the primary mitigation?
A white noise generator.
Might have to spend some time getting Easy Effects/Noise Torch set up on my systems again just to reduce the vectors again.
There is a good comment on this post on physical mitigation that seems helpful as well: https://www.reddit.com/r/Fedora/comments/uerp9z/comment/i6p0jqa/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button
Isn't boffin a derogatory term like "nerd"?
What a dogshit headline.
Article also uses the term "eggheads".
To go from keystroke sounds to actual letters, the eggheads recorded a person typing on a 16-inch 2021 MacBook Pro using a phone placed 17cm away and processed the sounds to get signatures of the keystrokes.
It’s The Register - think the Financial Times for IT but in the style of The Sun/any other British tabloid. They do it for the lulz, if you will - don’t get too hung up on the headlines as the content is top quality.
load more comments
(4 replies)
view more: next ›