Keyboard Sound Aids Password Cracking

stinerman writes "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session. The article details that their methods did not require a 'training text' in order to calibrate the conversion algorithm as has been used previously. The research paper [PDF] notes that '90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'"

Comments

Keyboard specific?

[markass530]

I'd have a hard time believing this method transcends all keyboard models, and all typists.

applicability?

[MooseTick]

If you can get a mike that close to a keyboard to listen to the keystrokes, then you can probably place a micro camera and get the same results.

Re:applicability?

[TripMaster Monkey]

How about a parabolic or shotgun mike?

75 attempts?

[jlower]

'90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.
All the systems where I work will lock you out after 5 bad attempts. What kind of password system lets you try 75 (or even 20) times?

Re:75 attempts?

[sammy baby]

Plenty of them. Implementing a lockout out of X number of bad attempts can open you up to some hairy denial of service attacks. Want to lock out a user for a few hours? Just fail to login as that person 5 times.

Not to say that the alternatives don't have their weaknesses, but this one certainly does as well.

As the article says:

[tabkey12]

It just goes to show that when you have physical access to a computer, the security's already broken...

Re:Use ASCII numerics, or pound the keyboard at lo

[Psykechan]

I use the Dvorak layout myself. It would help prevent this in two ways.

1. The keystroke timing would be much different
2. Constantly making errors which require much backspace pressing