Shake a Secure Bluetooth Connection

heilbron writes "The Austrian researcher Rene Mayrhofer of the British Lancaster university and his colleague Hans Gellersen developed a technology to simplify a secured wireless connection of mobile devices. With the so-called shake-to-connect technology an authenticated Bluetooth connection between two mobile phones is established by rhythmic shaking. Integrated oscillation sensors, contained in some mobile phone models, form the basis. The two researchers sketched out a prototype, which is intended for Nokia mobile phones. An example is documented in this YouTube video clip. If two mobile phones are shaken together, the software in both devices registers the same shaking frequency and authenticates the radio link. The principle is summed up in a four page PDF document."

Comments

Not just Cell phones use bluetooth

[nurb432]

I want to see you shake your bluetooth enabled car so you can sync with your phone, or spend the time shaking your keyboard and mouse ( and not look like an idiot ).

I can see a PDA getting loose during shaking and sending it flying under a bus. *crunch*

Re:Not just Cell phones use bluetooth

[Anonymous Coward]

You're absolutely right! I mean, since this idea can't be used for everything, then it's totally worthless!

Re:Not just Cell phones use bluetooth

[MankyD]

I want to see you shake your bluetooth enabled car so you can sync with your phone...

Perhaps you could - there's no reason a properly sensitive gyroscope can't detect the acceleration, turns, and even rumblings of a car and pair it up with a similarly moving phone.

Re:Not just Cell phones use bluetooth

[nurb432]

Although i was joking ( mostly ) to do what you propose you would have to strap the phone down to something sturdy like the dashboard, and not in one of those cute 'holsters' in order to get a accurate transferral of vibration.

Tossing it on the passenger seat wont work either.

Re:Not just Cell phones use bluetooth

[MT628496]

Right, like anyone on Slashdot will be doing what it normally takes to make a car shake.

Re:Not just Cell phones use bluetooth

[nurb432]

Not having properly balanced tires?

Re:Not just Cell phones use bluetooth

[dfghjk]

You don't have to shake the car, just shake the sensor that the car reads. Such a thing may be stupid but it would be trivially easy to implement. Glad to see you really thought about this before commmenting...

Because entering a PIN is sooooo difficult

[Coward Anonymous]

This is a solution looking for a problem...

Re:Because entering a PIN is sooooo difficult

[skiingyac]

Or a accelerometer manufacturer looking for a client...

If only ALL PHONES already had some way to accept input... Hmm... How about you hold both phones up to your mouth and whisper some random words into them at the same time? To encourage people from not all saying "12345", one phone could even display a random sequence of numbers that you then speak into the phones. It doesn't matter if you say the right numbers, since both phones are going off what they hear.

With the shaking method, someone can either watch you and try to shake theirs at the same time, or record a video of it and figure out what the acceleration values should be. With speaking, the attacker would have to get the sounds right, plus get the volume right, plus get the background noise & relative timing right (which is going to be slightly off unless the attacker is RIGHT next to you). Better yet, both phone owners could speak the sequence standing slightly apart, so nobody else will hear person #1, person #2, and the background noise with the same timings.

Wii uses bluetooth.

[Anonymous Coward]

"I need to shake my Wii."

Re:Wii uses bluetooth.

[morgan_greywolf]

"I need to shake my Wii." Damn. I'm having trouble with mine connecting. Can you come over here and shake my Wii for me?

Shake to Authenticate is a bad idea

[nahdude812]

The idea of the authentication system being two devices being shaken together seems like a weak idea. There are plenty of times when multiple devices will undergo the same accelerations as each other, and the owners of the respective devices do not necessarily intend for them to be paired. For example, sit next to someone on a bus.

Re:Shake to Authenticate is a bad idea

[Anonymous Coward]

maybe it'll finally give us a reason to outlaw line dancing! obviously violates the dmca

Re:Shake to Authenticate is a bad idea

[the_lesser_gatsby]

Why not just use the button to skip to the next song?

Re:Shake to Authenticate is a bad idea

[marcello_dl]

> The idea of the authentication system being two devices being shaken together seems like a weak idea.

Yep, why not provide a contact area for devices so you simply have to put them together? It could be used to exchange a key, or act with usb2 speed for data transfer with less effort than implementing accelerometers and software.

Re:Shake this!

[cloakable]

Yeah, but what'll you do when she says her taser is too, and offers to link?

Completely flipping pointless

[mlk]

Thinking about my use of Bluetooth:
a) Headset to phone auth - Done once when I bought the device, why would I want to make the headset heaver and more expenive.
b) Computer/phone auth - Done twice once with my home computer (a desktop-replacement laptop) and works desktop computer (not likely to pick that up and shake it)
c) Snyc with friends phone (share numbers) - I think I have done this once, normally I just send them a text message or quickly call them etc, but if I were to do it again I'd have to either let a friend shake my phone (top of the range smart phone) or a friend will let me shake his/hers (jokes abound). Mostly also top of the range smart phones. That is not likely to go down well.

Ringtone suggestions include...

[StarfishOne]

DJ Jazzy Jeff & The Fresh Prince - Boom! Shake The Room
The Beatles - Hippy Hippy Shake
Mariah Carey - Shake It Off
Seal Paul - Shake that thing
Ying Yang Twins - Shake
Eminem - Shake That: Edited Version
Howlin' Wolf - Shake It For Me
Beastie Boys - Shake Your Rump
Savage Garden - Break and shake me

Brownian motion authentication

[SpacePunk]

It's only a matter of time till you'll have to dunk both deviced into a cup of tea.

Why just shaking?

[dyftm]

Why just limit yourself to shaking, when you could use:

• Sound - put both devices together, speak into both of them at once
• Rhythmic button pressing - hold a device in each hand, tap out a rhythm on the buttons at the same time
• Sound pairing - put devices together, they use their speaker/mic to handshake

Connection

[hey]

How about plugging them into each other with USB, etc.
They could exchange tokens.
Then future Bluetooth communication would be pretty secure.
Oh wait, that's too sane.

Re:Connection

[stormguard2099]

I thought one of the main points of bluetooth was not having to use a cable? Yes, I realize that you wouldn't have to use the cord all of the time but everytime I've used my bluetooth it has been on a whim and a place where I was not around cords or anything.

Re:Bluetooth Request GUI

[rufo]

If the recipient's phone is set to be discoverable, you can beam stuff (most often contact info, but any type of data can work) ala Palm IR, complete with an allow/deny button. Thing is, most of the time you don't have discoverability enabled, and it's usually too inconvenient to dig through five layers of menus to get to the setting. At least with IR you need to point it at the other person's PDA, which acts as an informal permission system.

So not the point!

[pablo_max]

This is just one more example that the guys in the Bluetooth SIG do not understand the problems that are really there with Bluetooth. I mean honestly, how many times does anyone pair with a second phone? I would say almost never. 99% of Bluetooth users are using it for headset profile, or to sync their handset to the the computer. We will see much more phone book access profile stuff coming from car kits which enable you to control your phone in a better way, but not phone to phone. I work with Bluetooth for a living, and it can even take me more than an hour to get a Bluetooth stack working properly on a PC. I have heard so many stories that people can get their PC to pair with the headset the first time, but after a reboot, or standby, forget about it. These "interoperability" issues are what holds the tech back. This and the bonding procedure.

Great at Disneyland

[kabdib]

Must be great at an amusement park: You get off the roller-coaster with dozens of new friends.

Let's not contemplate what happens during an earthquake.

[I knew Bluetooth was in deep doo-doo in the late 90s, when I first saw a 900pp book on the protocols involved. Why is it that wireless-specific protocols are all garbage?]

MOD PARENT UP

[fmobus]

seriously, why is this not in use? It would make harder to access a bluetooth device without authorization, as it would require physical access...

In my dream bluetooth world, devices would only "pair" when connected with some sort of hermaphrodite interface (and would work wirelessly thereafter). Much like my wifi router: its initial setup was only accessible by its ethernet interfaces. This is the only way to rule out spoofings, man-in-the-middle attacks.