Is password entry being recorded on camera a realistic concern?
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting to see trends which indicate always-on cameras may become commonplace in other devices like glasses.
It has occurred to me, when out in public and entering my username/password into apps on my phone and laptop, that if a camera could capture both my screen and my keyboard, it could be fairly straightforward for a viewer to grab or guess my credentials from the footage assuming a high enough resolution image and the view not being (too) obscured.
Without going too much into the details of how it would be implemented, the accuracy and cost etc, I have a background in image processing and so am also aware that this would likely be automatable to at least some degree.
So I thought I would ask the community here if this is actually a viable risk? Have there been any known instances of it happening already? Are people thinking about this with respect to the viability of plaintext credential entry into apps in the long run?
passwords user-names
asked Nov 8 '18 at 15:42
davnicwil
806268
|
show 4 more comments
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting to see trends which indicate always-on cameras may become commonplace in other devices like glasses.
It has occurred to me, when out in public and entering my username/password into apps on my phone and laptop, that if a camera could capture both my screen and my keyboard, it could be fairly straightforward for a viewer to grab or guess my credentials from the footage assuming a high enough resolution image and the view not being (too) obscured.
Without going too much into the details of how it would be implemented, the accuracy and cost etc, I have a background in image processing and so am also aware that this would likely be automatable to at least some degree.
So I thought I would ask the community here if this is actually a viable risk? Have there been any known instances of it happening already? Are people thinking about this with respect to the viability of plaintext credential entry into apps in the long run?
passwords user-names
asked Nov 8 '18 at 15:42
davnicwil
806268
31
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
20
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
4
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
2
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
3
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22
|
show 4 more comments
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting to see trends which indicate always-on cameras may become commonplace in other devices like glasses.
It has occurred to me, when out in public and entering my username/password into apps on my phone and laptop, that if a camera could capture both my screen and my keyboard, it could be fairly straightforward for a viewer to grab or guess my credentials from the footage assuming a high enough resolution image and the view not being (too) obscured.
Without going too much into the details of how it would be implemented, the accuracy and cost etc, I have a background in image processing and so am also aware that this would likely be automatable to at least some degree.
So I thought I would ask the community here if this is actually a viable risk? Have there been any known instances of it happening already? Are people thinking about this with respect to the viability of plaintext credential entry into apps in the long run?
passwords user-names
asked Nov 8 '18 at 15:42
davnicwil
806268
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting to see trends which indicate always-on cameras may become commonplace in other devices like glasses.
It has occurred to me, when out in public and entering my username/password into apps on my phone and laptop, that if a camera could capture both my screen and my keyboard, it could be fairly straightforward for a viewer to grab or guess my credentials from the footage assuming a high enough resolution image and the view not being (too) obscured.
Without going too much into the details of how it would be implemented, the accuracy and cost etc, I have a background in image processing and so am also aware that this would likely be automatable to at least some degree.
So I thought I would ask the community here if this is actually a viable risk? Have there been any known instances of it happening already? Are people thinking about this with respect to the viability of plaintext credential entry into apps in the long run?
passwords user-names
passwords user-names
asked Nov 8 '18 at 15:42
davnicwil
806268
asked Nov 8 '18 at 15:42
davnicwil
806268
asked Nov 8 '18 at 15:42
davnicwil
806268
asked Nov 8 '18 at 15:42
davnicwil
806268
asked Nov 8 '18 at 15:42
davnicwil
806268
806268
31
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
20
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
4
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
2
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
3
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22
|
show 4 more comments
31
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
20
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
4
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
2
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
3
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22
31
31
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
20
20
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
4
4
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
2
2
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
3
3
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22
|
show 4 more comments
6 Answers
6
active
oldest
votes
Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.
Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.
And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.
I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.
So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.
The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.
edited Nov 12 '18 at 19:49
Mr. C
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
|
show 12 more comments
As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)
Hidden camera behind ATM faceplate (source)
Hidden camera glued to corner of ATM (source)
Hidden camera on fake panel of ATM (source)
So yes, it is a very real-world concern.
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
add a comment |
Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.
answered Nov 8 '18 at 22:05
rackandboneman
74137
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
|
show 3 more comments
Something that may help: Get into the habbit of "pressing" a few buttons in addition to your password.
Say, your password is 1234. You could hit the 1 and 2, pretend to press, say, 9, and then continue your password.
It discourages any cameras, key-wear down, or onlookers. It's certainly low grade, yes, but it deters people who have 1000 other clips of footage to go through.
answered Nov 13 '18 at 1:26
Kyle
1212
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
add a comment |
Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.
answered Nov 9 '18 at 1:48
R..
4,58711418
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
add a comment |
I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".
Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.
On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.
For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.
Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.
answered Nov 9 '18 at 23:24
Amadeus
1811
add a comment |
protected by Jeff Ferland♦ Nov 13 '18 at 18:09
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
6 Answers
6
active
oldest
votes
6 Answers
6
active
oldest
votes
active
oldest
votes
active
oldest
votes
Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.
Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.
And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.
I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.
So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.
The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.
edited Nov 12 '18 at 19:49
Mr. C
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
|
show 12 more comments
Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.
Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.
And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.
I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.
So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.
The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.
edited Nov 12 '18 at 19:49
Mr. C
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
|
show 12 more comments
Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.
Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.
And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.
I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.
So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.
The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.
edited Nov 12 '18 at 19:49
Mr. C
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.
Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.
And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.
I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.
So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.
The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.
edited Nov 12 '18 at 19:49
Mr. C
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
edited Nov 12 '18 at 19:49
Mr. C
1033
edited Nov 12 '18 at 19:49
Mr. C
1033
edited Nov 12 '18 at 19:49
Mr. C
1033
1033
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
answered Nov 8 '18 at 15:46
schroeder♦
73.3k29160195
73.3k29160195
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
|
show 12 more comments
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
65
65
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
I would also add that there has been a case where a high-res photo was taken of a finger and used to create a replica fingerprint and used to open the biometrics of a phone. So, yes, cameras are a threat.
– schroeder♦
Nov 8 '18 at 15:58
11
11
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
I think the new factor with cameras is the potential for scale through both wider passive capture and automation
– davnicwil
Nov 8 '18 at 16:10
4
4
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
@davnicwil yep, that's a good point too. When designing the camera placement in an office building, we had to perform a number of calculations on the risks of capturing people typing. What I'm saying is that the problem space is far from new.
– schroeder♦
Nov 8 '18 at 16:38
10
10
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
@Bakuriu I might humbly suggest that not everyone lives in Italy. Especially in cases where a company has sensitive info to protect, or high-value goods, further video surveillance may be warranted to minimize liability and risk.
– Doktor J
Nov 8 '18 at 20:30
5
5
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
@bakuriu the answer is simply that there was a business need and there were no barriers to doing it the way we did
– schroeder♦
Nov 8 '18 at 21:27
|
show 12 more comments
As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)
Hidden camera behind ATM faceplate (source)
Hidden camera glued to corner of ATM (source)
Hidden camera on fake panel of ATM (source)
So yes, it is a very real-world concern.
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
add a comment |
As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)
Hidden camera behind ATM faceplate (source)
Hidden camera glued to corner of ATM (source)
Hidden camera on fake panel of ATM (source)
So yes, it is a very real-world concern.
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
add a comment |
As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)
Hidden camera behind ATM faceplate (source)
Hidden camera glued to corner of ATM (source)
Hidden camera on fake panel of ATM (source)
So yes, it is a very real-world concern.
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)
Hidden camera behind ATM faceplate (source)
Hidden camera glued to corner of ATM (source)
Hidden camera on fake panel of ATM (source)
So yes, it is a very real-world concern.
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
answered Nov 8 '18 at 23:07
BlueRaja - Danny Pflughoeft
1,8451118
1,8451118
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
add a comment |
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
I'd like to point out that the two ATM images are different in other ways too. For example, the card slot on the right in the ATM machine seems to have changed between the two images. There seems to be some sort of protruding card slot in the second image. What is this?
– fortunate_man
Nov 10 '18 at 13:44
7
7
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
@fortunate_man It's the actual skimmer that records the data on the magnetic stripe on the card. It's what you actually want to be looking for when using an ATM, since your PIN is useless without it, but the reverse isn't necessarily true.
– Ross Ridge
Nov 10 '18 at 16:28
1
1
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
I'm surprised you didn't include krebsonsecurity.com/2012/09/…, which much more directly answers the question.
– Wildcard
Nov 12 '18 at 18:39
add a comment |
Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.
answered Nov 8 '18 at 22:05
rackandboneman
74137
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
|
show 3 more comments
Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.
answered Nov 8 '18 at 22:05
rackandboneman
74137
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
|
show 3 more comments
Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.
answered Nov 8 '18 at 22:05
rackandboneman
74137
Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.
answered Nov 8 '18 at 22:05
rackandboneman
74137
answered Nov 8 '18 at 22:05
rackandboneman
74137
answered Nov 8 '18 at 22:05
rackandboneman
74137
answered Nov 8 '18 at 22:05
rackandboneman
74137
74137
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
|
show 3 more comments
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
25
25
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
My relatively cheap chinese door lock have a (I don't know if this is intentionaly or it just happened) way off deterring shoulder-surfers: Only the first and the last n digits matters. So, if the code is 1234, if you are suspicious somebody is watching, you could enter 124579413245430234, and most snoopers would have lost track of your keys by then. All keys would have the same temperature and greasiness also.
– Lenne
Nov 9 '18 at 11:02
2
2
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
@Lenne but if someone can (secretly?) record you two or more times, instead of just shoulder-surfing, can't they figure out actual code by comparing few inputs? :)
– Ivan Kolmychek
Nov 9 '18 at 19:24
2
2
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
Sure, but even if something isn't 100% protection, everything which makes it harder will stop some, and delay the rest
– Lenne
Nov 9 '18 at 19:46
2
2
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
@Lenne that lock could be much improved by not accepting an EXACT entered number combination for several attempts....
– rackandboneman
Nov 9 '18 at 21:22
4
4
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
I think, smear traces on smart phone screens also fall in this category
– Hagen von Eitzen
Nov 10 '18 at 10:15
|
show 3 more comments
Something that may help: Get into the habbit of "pressing" a few buttons in addition to your password.
Say, your password is 1234. You could hit the 1 and 2, pretend to press, say, 9, and then continue your password.
It discourages any cameras, key-wear down, or onlookers. It's certainly low grade, yes, but it deters people who have 1000 other clips of footage to go through.
answered Nov 13 '18 at 1:26
Kyle
1212
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
add a comment |
Something that may help: Get into the habbit of "pressing" a few buttons in addition to your password.
Say, your password is 1234. You could hit the 1 and 2, pretend to press, say, 9, and then continue your password.
It discourages any cameras, key-wear down, or onlookers. It's certainly low grade, yes, but it deters people who have 1000 other clips of footage to go through.
answered Nov 13 '18 at 1:26
Kyle
1212
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
add a comment |
Something that may help: Get into the habbit of "pressing" a few buttons in addition to your password.
Say, your password is 1234. You could hit the 1 and 2, pretend to press, say, 9, and then continue your password.
It discourages any cameras, key-wear down, or onlookers. It's certainly low grade, yes, but it deters people who have 1000 other clips of footage to go through.
answered Nov 13 '18 at 1:26
Kyle
1212
Something that may help: Get into the habbit of "pressing" a few buttons in addition to your password.
Say, your password is 1234. You could hit the 1 and 2, pretend to press, say, 9, and then continue your password.
It discourages any cameras, key-wear down, or onlookers. It's certainly low grade, yes, but it deters people who have 1000 other clips of footage to go through.
answered Nov 13 '18 at 1:26
Kyle
1212
answered Nov 13 '18 at 1:26
Kyle
1212
answered Nov 13 '18 at 1:26
Kyle
1212
answered Nov 13 '18 at 1:26
Kyle
1212
1212
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
add a comment |
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
I do this often. Being a touch typist helps. Just put your fingers in position, and press the actual pin numbers amongst the faux key presses as you wish. The only key press that stands out is pressing the enter key.
– ouflak
Nov 14 '18 at 11:48
add a comment |
Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.
answered Nov 9 '18 at 1:48
R..
4,58711418
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
add a comment |
Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.
answered Nov 9 '18 at 1:48
R..
4,58711418
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
add a comment |
Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.
answered Nov 9 '18 at 1:48
R..
4,58711418
Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.
answered Nov 9 '18 at 1:48
R..
4,58711418
answered Nov 9 '18 at 1:48
R..
4,58711418
answered Nov 9 '18 at 1:48
R..
4,58711418
answered Nov 9 '18 at 1:48
R..
4,58711418
4,58711418
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
add a comment |
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
Comments are not for extended discussion; this conversation has been moved to chat.
– Rory Alsop♦
Nov 10 '18 at 19:59
add a comment |
I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".
Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.
On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.
For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.
Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.
answered Nov 9 '18 at 23:24
Amadeus
1811
add a comment |
I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".
Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.
On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.
For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.
Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.
answered Nov 9 '18 at 23:24
Amadeus
1811
add a comment |
I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".
Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.
On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.
For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.
Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.
answered Nov 9 '18 at 23:24
Amadeus
1811
I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".
Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.
On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.
For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.
Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.
answered Nov 9 '18 at 23:24
Amadeus
1811
answered Nov 9 '18 at 23:24
Amadeus
1811
answered Nov 9 '18 at 23:24
Amadeus
1811
answered Nov 9 '18 at 23:24
Amadeus
1811
1811
add a comment |
add a comment |
protected by Jeff Ferland♦ Nov 13 '18 at 18:09
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
31
Entering credentials in public is always a risk.
– stackzebra
Nov 9 '18 at 8:12
20
Related: Snowden's Blanket - He wouldn't use the blanket if there was no risk of seeing him type.
– Mindwin
Nov 9 '18 at 14:31
4
Take a look at TOTP - Time-based One Time Passwords. Typically used for 2FA, you can use them as the only factor as well. I have a few servers set up that accept either for SSH.
– Duncan X Simpson
Nov 10 '18 at 4:28
2
Well, my bank will (against my explicit consent) pay up to 50€ per transaction without my card ever being inserted in a reader, only using some wireless transponder shit, and without any security token whatsoever being provided. So, seeing how my south Korean phone unlocks on my fingerprint and keeps my super important Instagram password hardware encrypted, I see password skimming as the smaller of two problems.
– Damon
Nov 12 '18 at 11:49
3
Who is your adversary in the threat model? Government has such plenties of cameras, but doesn't need you to disclose your password to spy on you.
– usr-local-ΕΨΗΕΛΩΝ
Nov 12 '18 at 16:22