Shake a Secure Bluetooth Connection

heilbron writes "The Austrian researcher Rene Mayrhofer of the British Lancaster university and his colleague Hans Gellersen developed a technology to simplify a secured wireless connection of mobile devices. With the so-called shake-to-connect technology an authenticated Bluetooth connection between two mobile phones is established by rhythmic shaking. Integrated oscillation sensors, contained in some mobile phone models, form the basis. The two researchers sketched out a prototype, which is intended for Nokia mobile phones. An example is documented in this YouTube video clip. If two mobile phones are shaken together, the software in both devices registers the same shaking frequency and authenticates the radio link. The principle is summed up in a four page PDF document."

Comments

Not just Cell phones use bluetooth

[nurb432]

I want to see you shake your bluetooth enabled car so you can sync with your phone, or spend the time shaking your keyboard and mouse ( and not look like an idiot ).

I can see a PDA getting loose during shaking and sending it flying under a bus. *crunch*

Re:Not just Cell phones use bluetooth

[Anonymous Coward]

You're absolutely right! I mean, since this idea can't be used for everything, then it's totally worthless!

Re:Not just Cell phones use bluetooth

[MankyD]

I want to see you shake your bluetooth enabled car so you can sync with your phone...

Perhaps you could - there's no reason a properly sensitive gyroscope can't detect the acceleration, turns, and even rumblings of a car and pair it up with a similarly moving phone.

Because entering a PIN is sooooo difficult

[Coward Anonymous]

This is a solution looking for a problem...

Re:Because entering a PIN is sooooo difficult

[skiingyac]

Or a accelerometer manufacturer looking for a client...

If only ALL PHONES already had some way to accept input... Hmm... How about you hold both phones up to your mouth and whisper some random words into them at the same time? To encourage people from not all saying "12345", one phone could even display a random sequence of numbers that you then speak into the phones. It doesn't matter if you say the right numbers, since both phones are going off what they hear.

With the shaking method, someone can either watch you and try to shake theirs at the same time, or record a video of it and figure out what the acceleration values should be. With speaking, the attacker would have to get the sounds right, plus get the volume right, plus get the background noise & relative timing right (which is going to be slightly off unless the attacker is RIGHT next to you). Better yet, both phone owners could speak the sequence standing slightly apart, so nobody else will hear person #1, person #2, and the background noise with the same timings.

Shake to Authenticate is a bad idea

[nahdude812]

The idea of the authentication system being two devices being shaken together seems like a weak idea. There are plenty of times when multiple devices will undergo the same accelerations as each other, and the owners of the respective devices do not necessarily intend for them to be paired. For example, sit next to someone on a bus.

Re:Shake to Authenticate is a bad idea

[the_lesser_gatsby]

Why not just use the button to skip to the next song?

Re:Shake to Authenticate is a bad idea

[marcello_dl]

> The idea of the authentication system being two devices being shaken together seems like a weak idea.

Yep, why not provide a contact area for devices so you simply have to put them together? It could be used to exchange a key, or act with usb2 speed for data transfer with less effort than implementing accelerometers and software.

Re:Wii uses bluetooth.

[morgan_greywolf]

"I need to shake my Wii." Damn. I'm having trouble with mine connecting. Can you come over here and shake my Wii for me?

Completely flipping pointless

[mlk]

Thinking about my use of Bluetooth:
a) Headset to phone auth - Done once when I bought the device, why would I want to make the headset heaver and more expenive.
b) Computer/phone auth - Done twice once with my home computer (a desktop-replacement laptop) and works desktop computer (not likely to pick that up and shake it)
c) Snyc with friends phone (share numbers) - I think I have done this once, normally I just send them a text message or quickly call them etc, but if I were to do it again I'd have to either let a friend shake my phone (top of the range smart phone) or a friend will let me shake his/hers (jokes abound). Mostly also top of the range smart phones. That is not likely to go down well.

Connection

[hey]

How about plugging them into each other with USB, etc.
They could exchange tokens.
Then future Bluetooth communication would be pretty secure.
Oh wait, that's too sane.