Keyboard Sound Aids Password Cracking

stinerman writes "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session. The article details that their methods did not require a 'training text' in order to calibrate the conversion algorithm as has been used previously. The research paper [PDF] notes that '90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'"

My Luggage

[Valiss]

'90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'

Looks like you're screwed because my luggage password is 5 digits long, but all digits are numbers in a sequential order starting with one. Ha ha!
 

Another old fashioned way to get passwords w audio

[xxxJonBoyxxx]

Another old fashioned way to get passwords w audio: Just tap the "help desk" phone line.

It's a good thing...

[Nuclear Elephant]

... that my voice is my passport.

Hunt and peck for safety?

[Alcimedes]

Go figure, typing properly now means you get your password cracked.

Guess that's all the more reason to keep that Cheetos bag crinkling as you type. Gotta stop the commies!

WARNING

[JamesD_UK]

Security experts recommend you don't speak the name of the key you're hunting for as you type your password with a single finger.

Re:My Luggage

[loimprevisto]

What? 1,2,3,4,5? Only an moron would use that combination for their luggage!

Great...

[crc32]

Now I'll need tinfoil wallpaper too, time to go to Cosco...

thts why im s0 l33t.

[JVert]

H0miez hav mic's all 0ver i know. So I do wh4t is ne3ded to k3ep my info s4fe.

Easy Fix

[jatemack]

Just make a clicking noise with your tongue and the roof of your mouth as you type. It sounds almost identical, and you'll automatically sync the sound up with each keystroke.

Try it.

Re:applicability?

[rot26]

Good idea. They sell those at the same movie prop houses that carry 57-shot revolvers, self-igniting gasoline, and phones with "AT&T" written on every surface.

Crap! I use a Model M!

[allanc]

With these clicky buckling springs, they'll be able to sniff my password from miles away!

Re:Great...

[rtaylor]

Now I'll need tinfoil wallpaper too, time to go to Cosco...

Tinfoil was eliminated by the government and replaced with aluminum foil. Your wallpaper and hats only make you believe you're safe.

Agent x86

[Molina the Bofh]

Be careful, chief. Lets type in the cone of silence.

Now it's time to say goodbye, to all our company..

[Anonymous Coward]

This reminds me of a sysop I once worked with. Every time he logged in you could clearly identify the rhythm of M-I-C-K-E-Y M-O-U-S-E. Sometimes he was even stupid enough to hum the tune as he typed it. And this idiot was one of the senior IT guys at a major oil company.

Re:Redbox for keyboards now?

[o7400]

That's it. From now on, whenever I'm typing a password I'm going to scream at the top of my lungs. How about that stopid password stealers!?

A little known fact

[Klowner]

It's also incredibly helpful when they mumble their password as they type it.

Re:Redbox for keyboards now?

[TripMaster Monkey]

Spyware attempting to hash out your keystrokes by listening to the keypresses instead of grabbing the strokes directly is a bit like a person trying to enjoy music by watching the equalizer lights flicker instead of using the speakers.

Re:Berkley != Berkeley

[Anonymous Coward]

It is actually a typo [...] not caught by Taco.

I'm amazed. No, stunned. No.. umm, what's the opposite of "amazed" again? :o)

Re:My Luggage

[Rick.C]

What? 1,2,3,4,5? Only an moron would use that combination for their luggage!

Shhhh! That's not the combination he set - that's the TSA's "back-door" combo.

Re:Redbox for keyboards now?

[Daniel_Staal]

...like a person trying to enjoy music by watching the equalizer lights flicker instead of using the speakers.

Hey, I've done that! It's a great exercize for increasing the pattern-matching ablities of your brain! You have no idea how good it feels when you finally 'hear' the music just by watching the lights...

(Well, at least I think so.)

I just deduced a password from this article

[digitaldc]

it is 'password' It works about 25% of the time.

Re:...and it corrects typos!

[vertinox]

What is the USPS doing with this type of research?

To find methods to read your unopened mail by listening to it.

Re:Redbox for keyboards now?

[TheViciousOverWind]

You have no idea how good it feels when you finally 'hear' the music just by watching the lights...

Why don't you volunteer for a charity? It sounds like you have enough time on your hands to save the world singlehandedly.

Re:Keyboard specific?

[Anonymous Coward]

Learn logic.

Re:A quick idea that just popped into my noggin:

[Anonymous Coward]

Maybe while we're waiting around for the target to log into his computer, touch none of the other keys, and immediately leave, we can get to work on a teleporter to remotely swap out his keyboard before he comes back. Oh, and bonus! We can beam his original keyboard right into the fingerprint oil age analysis machine (with millisecond accuracy so that we can truly "backtrack" his password) that we'll also invent.

Re:Redbox for keyboards now?

[avronius]

Some potential titles for the afore mentioned 80's movie:
"Remix Of The Killer Tomatoes"
"Return Of The Password Snatchers"
"They Listened from Within"
"Buffy The Keystroke Logger" (not quite on-topic)
"I Know What You Typed Last Summer"
"Eavesdropper"
"The Computers Have Ears"

The unrelated horror film we're most likely to see?
"The Blog" - with Steve McQueen re-animated to reprise his role as "Steve Andrews"
Genre: Horror / Sci-Fi / Comedy
Tagline: Indescribable... Indestructible! Nothing Can Stop It!
Plot Outline: An inane personal web log consumes all bandwidth in its path as it grows and grows.

Re:Redbox for keyboards now?

[Daniel_Staal]

Why don't you volunteer for a charity? It sounds like you have enough time on your hands to save the world singlehandedly.

I am now out of college.

It can't work for me...

[cyberbrown]

I write /whois and /away much more often than my passwords.
Yes, I'm IRC addicted...

Re:Great...

[OzPeter]

If you knew your world history you would know that it was an early 20th century right wing plot to get the US to use aluminum instead of the aluminium that the rest of the world uses.

You see while aluminum looks and feels a lot like aluminium, it is actually a differant material, so much so that it cannot be used as a tinfoil hat replacement.

Thus by duping the US citizens into believing that aluminum was just as good as aluminium (and more patriotic for the country), the government easily gained the capability of reading all of your thoughts, even when you thought they couldn't [*]

As of now, the rest of English speaking world sits smuggly by wearing our aluminium foil hats, safe in the knowledge that our thoughts are secure.

[*] Unfortunatley there was a side effect to being able to read the thoughts of everyone in the US. The summaries of such thoughts are used to brief the president in order to help him direct policy. But starting with the Shiny Shiny movements of the mid 80's suceeding presidents have slowly become paralysed by the thoughts of the mass population. This has come to a head with GWB being briefed hourly about how the population feels about JLo and Bennifer, while other, more important items are ignored.

The only possible solution to this is to disband the remote thought readings, but when confronted with leftist radical ideas like this, the CIA/Industro-Military Complex reacts violently and labels such ideas as being the work of terrorists. (It should be noted that these people are known to have holdings of aluminium manufacturers in other countries, thus securing their *private* supply of aluminium foil hats).

And now let's check in on the FBI...

[halcyon1234]

... in their "Audio-Based Password Cracking Lab".

Here we see Agent Small and Agent Geoffries working on a real, live Password Hacking "Evesdrop Machine". If they can just hear enough of the nefarious criminal's activities, the can garner all of his secrets.

AS: Okay, we're getting something.
EM: *click click clickity click*
AG: What was that?
AS: It sounded like a URL. He must be going to a website. The machine will try to crack the URL.
EM: *click*
AG: That was a mouse click, wasn't it?
AS: Yup, not very helpful.
EM: *thump thump thump thump*
AG: What's that?
AS: It sounds like a hard and regular pounding of something. I can't quite make it out.
AG: Hey, the machine's got the url. www.ultimatepron....
EM: *thump thump thumpthumpthump...spalsh*
AG&AS: Ewwww!

Re:applicability?

[zizzo]

How about a zoom lens?

The parent poster is right. Photographic techniques are probably easier across the board. But there is no reason you can't use both.

I'm ok though. I type in my password with mittens in a dark room. I wish they would let me out of here.

Re:Keyboard specific?

[aardvarkjoe]

I will defeat this by entering my password in Morse code.

Oh, crap.

Re:Keyboard specific?

[Opie812]

on

Re:Passwords are obsolete

[FhnuZoag]

Got a bright idea? Maybe we should just glue the user to the computer.

Re:Redbox for keyboards now?

[Dirtside]

Thank god I've spent the last five years practicing how to make keyboard clicking sounds with my mouth. You'll never get my password!