To whom it may concern,
Whoops we ruined everything.
Best regards, Humanity
Time to make a keyboard that self switches between qwerty, colemak, etc and has some sort of indicator of it’s layout, and spits out random recordings of its own key presses, and you just have to be insane to type on it correctly.
This isnt a new attack. Its been around for years. The newest scary development of this was that a website with a decent frontend was made for it but that was months ago. Use a password manager.
I felt a great disturbance in the Force, as if millions of mechanical keyboards suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened.
Streamers especially are going to have to be incredibly careful going forward
Not as much as you might think. A lot of audio communication softwares these days have some sort of background noise filter, not saying thay are perfect but they have been increasingly in effectiveness and adoption. My graphics card (nvidia) even supports it and works well. That plus my quiet switches, I’m not too worried about myself, or tech savvy streamers.
The biggest target is probably the elderly and less tech savvy, who are also more likely to fall for scams, and probably have less password entropy (which would make this software more accurate).
They can just go back to dome keyboard that don’t make any sounds. Mechanical keyboard hype is overblown.
The article addresses exactly this suggestion.
Remember, the attack model proved highly effective even against a very silent keyboard, so adding sound dampeners on mechanical keyboards or switching to membrane-based keyboards is unlikely to help.
Ai has gone too far!
What about a touchscreen keyboard? The layout wouldn’t have to change, and there needn’t be any sounds at all.
I know it’s shitty but for high security purposes like on a bank terminal or something, shitty but secure trumps nice but insecure, right?
Might be for you, but for whatever reason my brain really, really hates the tactile feel of rubber domes.
I’ve also always had strong issues with certain textures/tactile feels in general
Yeah, rubber domes suck. They are way too mushy.
I hate how the actuation force changes a lot during a key press.
Another reason to use a password manager
What if the keyboard is not made of homogenous switches? Some reds, silvers, blues and browns thrown randomly around the keyboard ought to defeat the model, right?
As long as they can’t train the model on your specific keyboard yeah. If they can it would probably be even easier for it since the keys would be more distinct.
Yeah that would make my keyboard signature even more unique. Though you could always hotswap some keys around every few weeks
How does that even work? Like, all the keys are generally manufactured to the same standards such that any physical difference in keys causing different sounds is a combination of user damage and random factory errors, no?
Distance from microphone?
Probably, but it’s definitely there. I managed to tell that one of my friend’s pin had the same key twice in it because i heard the same kind of sound twice.
I mean sure, but “same key twice” isn’t exactly a specific character to type. I mean I hit caps lock twice typing my password for this site.
I can’t wait for passwords to be replaced with a cryptographic solution. Even with a password manager, login forms are an unnecessary waste of time.
What makes this new or different from previous methods? Just because “AI”?
Were you previously able to identify what someone typed with 96% precision based entirely on the sound of their keyboard? Because I would wager most people cannot
My point is, this is not a new thing: They have previously been able to effectively keylog based on sound. What makes this different?
https://miloserdov.org/?p=3209
https://news.ycombinator.com/item?id=18568795
https://gizmodo.com/website-can-track-mechanical-keyboard-typing-just-by-li-1848890545
This one is different from other similar attacks because it works against extremely quiet keyboards
