Shake a Secure Bluetooth Connection

heilbron writes "The Austrian researcher Rene Mayrhofer of the British Lancaster university and his colleague Hans Gellersen developed a technology to simplify a secured wireless connection of mobile devices. With the so-called shake-to-connect technology an authenticated Bluetooth connection between two mobile phones is established by rhythmic shaking. Integrated oscillation sensors, contained in some mobile phone models, form the basis. The two researchers sketched out a prototype, which is intended for Nokia mobile phones. An example is documented in this YouTube video clip. If two mobile phones are shaken together, the software in both devices registers the same shaking frequency and authenticates the radio link. The principle is summed up in a four page PDF document."

Comments

Re:Not just Cell phones use bluetooth

[MankyD]

I want to see you shake your bluetooth enabled car so you can sync with your phone...

Perhaps you could - there's no reason a properly sensitive gyroscope can't detect the acceleration, turns, and even rumblings of a car and pair it up with a similarly moving phone.

Re:Not just Cell phones use bluetooth

[nurb432]

Although i was joking ( mostly ) to do what you propose you would have to strap the phone down to something sturdy like the dashboard, and not in one of those cute 'holsters' in order to get a accurate transferral of vibration.

Tossing it on the passenger seat wont work either.

Why just shaking?

[dyftm]

Why just limit yourself to shaking, when you could use:

• Sound - put both devices together, speak into both of them at once
• Rhythmic button pressing - hold a device in each hand, tap out a rhythm on the buttons at the same time
• Sound pairing - put devices together, they use their speaker/mic to handshake

Re:Bluetooth Request GUI

[rufo]

If the recipient's phone is set to be discoverable, you can beam stuff (most often contact info, but any type of data can work) ala Palm IR, complete with an allow/deny button. Thing is, most of the time you don't have discoverability enabled, and it's usually too inconvenient to dig through five layers of menus to get to the setting. At least with IR you need to point it at the other person's PDA, which acts as an informal permission system.

Re:Because entering a PIN is sooooo difficult

[skiingyac]

Or a accelerometer manufacturer looking for a client...

If only ALL PHONES already had some way to accept input... Hmm... How about you hold both phones up to your mouth and whisper some random words into them at the same time? To encourage people from not all saying "12345", one phone could even display a random sequence of numbers that you then speak into the phones. It doesn't matter if you say the right numbers, since both phones are going off what they hear.

With the shaking method, someone can either watch you and try to shake theirs at the same time, or record a video of it and figure out what the acceleration values should be. With speaking, the attacker would have to get the sounds right, plus get the volume right, plus get the background noise & relative timing right (which is going to be slightly off unless the attacker is RIGHT next to you). Better yet, both phone owners could speak the sequence standing slightly apart, so nobody else will hear person #1, person #2, and the background noise with the same timings.

Great at Disneyland

[kabdib]

Must be great at an amusement park: You get off the roller-coaster with dozens of new friends.

Let's not contemplate what happens during an earthquake.

[I knew Bluetooth was in deep doo-doo in the late 90s, when I first saw a 900pp book on the protocols involved. Why is it that wireless-specific protocols are all garbage?]