Slashdot Mirror
Keyboard Sound Aids Password Cracking
stinerman writes "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session. The article details that their methods did not require a 'training text' in order to calibrate the conversion algorithm as has been used previously. The research paper [PDF] notes that '90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'"
'90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'
Looks like you're screwed because my luggage password is 5 digits long, but all digits are numbers in a sequential order starting with one. Ha ha!
-Valiss
Another old fashioned way to get passwords w audio: Just tap the "help desk" phone line.
... that my voice is my passport.
Go figure, typing properly now means you get your password cracked.
Guess that's all the more reason to keep that Cheetos bag crinkling as you type. Gotta stop the commies!
Security experts recommend you don't speak the name of the key you're hunting for as you type your password with a single finger.
Now I'll need tinfoil wallpaper too, time to go to Cosco...
"In order to make an apple pie from scratch, you must first create the universe." -- Carl Sagan, Cosmos
H0miez hav mic's all 0ver i know. So I do wh4t is ne3ded to k3ep my info s4fe.
Just make a clicking noise with your tongue and the roof of your mouth as you type. It sounds almost identical, and you'll automatically sync the sound up with each keystroke.
Try it.
// no
Good idea. They sell those at the same movie prop houses that carry 57-shot revolvers, self-igniting gasoline, and phones with "AT&T" written on every surface.
To ensure perfect aim, shoot first and call whatever you hit the target
With these clicky buckling springs, they'll be able to sniff my password from miles away!
Be careful, chief. Lets type in the cone of silence.
-
Roses are #FF0000, Violets are #0000FF, find / -name '*base*' |xargs chown -R us && mv zig greatjustice
This reminds me of a sysop I once worked with. Every time he logged in you could clearly identify the rhythm of M-I-C-K-E-Y M-O-U-S-E. Sometimes he was even stupid enough to hum the tune as he typed it. And this idiot was one of the senior IT guys at a major oil company.
That's it. From now on, whenever I'm typing a password I'm going to scream at the top of my lungs. How about that stopid password stealers!?
It's also incredibly helpful when they mumble their password as they type it.
Spyware attempting to hash out your keystrokes by listening to the keypresses instead of grabbing the strokes directly is a bit like a person trying to enjoy music by watching the equalizer lights flicker instead of using the speakers.
____
~ |rip/\/\aster /\/\onkey
It is actually a typo [...] not caught by Taco.
:o)
I'm amazed. No, stunned. No.. umm, what's the opposite of "amazed" again?
Hey, I've done that! It's a great exercize for increasing the pattern-matching ablities of your brain! You have no idea how good it feels when you finally 'hear' the music just by watching the lights...
(Well, at least I think so.)
'Sensible' is a curse word.
it is 'password' It works about 25% of the time.
He who knows best knows how little he knows. - Thomas Jefferson
What is the USPS doing with this type of research?
To find methods to read your unopened mail by listening to it.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
You have no idea how good it feels when you finally 'hear' the music just by watching the lights...
Why don't you volunteer for a charity? It sounds like you have enough time on your hands to save the world singlehandedly.
My <1000 UID is with a hot chick
Learn logic.
Maybe while we're waiting around for the target to log into his computer, touch none of the other keys, and immediately leave, we can get to work on a teleporter to remotely swap out his keyboard before he comes back. Oh, and bonus! We can beam his original keyboard right into the fingerprint oil age analysis machine (with millisecond accuracy so that we can truly "backtrack" his password) that we'll also invent.
Some potential titles for the afore mentioned 80's movie:
"Remix Of The Killer Tomatoes"
"Return Of The Password Snatchers"
"They Listened from Within"
"Buffy The Keystroke Logger" (not quite on-topic)
"I Know What You Typed Last Summer"
"Eavesdropper"
"The Computers Have Ears"
The unrelated horror film we're most likely to see?
"The Blog" - with Steve McQueen re-animated to reprise his role as "Steve Andrews"
Genre: Horror / Sci-Fi / Comedy
Tagline: Indescribable... Indestructible! Nothing Can Stop It!
Plot Outline: An inane personal web log consumes all bandwidth in its path as it grows and grows.
I am now out of college.
'Sensible' is a curse word.
I write /whois and /away much more often than my passwords.
Yes, I'm IRC addicted...
Here we see Agent Small and Agent Geoffries working on a real, live Password Hacking "Evesdrop Machine". If they can just hear enough of the nefarious criminal's activities, the can garner all of his secrets.
AS: Okay, we're getting something.
EM: *click click clickity click*
AG: What was that?
AS: It sounded like a URL. He must be going to a website. The machine will try to crack the URL.
EM: *click*
AG: That was a mouse click, wasn't it?
AS: Yup, not very helpful.
EM: *thump thump thump thump*
AG: What's that?
AS: It sounds like a hard and regular pounding of something. I can't quite make it out.
AG: Hey, the machine's got the url. www.ultimatepron....
EM: *thump thump thumpthumpthump...spalsh*
AG&AS: Ewwww!
UTF-8: There and Back Again
How about a zoom lens?
The parent poster is right. Photographic techniques are probably easier across the board. But there is no reason you can't use both.
I'm ok though. I type in my password with mittens in a dark room. I wish they would let me out of here.
Oh, crap.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
on
I'm not a nerd. Nerds are smart.
Got a bright idea? Maybe we should just glue the user to the computer.
Thank god I've spent the last five years practicing how to make keyboard clicking sounds with my mouth. You'll never get my password!
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased