We were unable to load Disqus. If you are a moderator please see our troubleshooting guide.

Mario S Nusbaum • 1 year ago

How do they acquire a thermal image of a keyboard or touchscreen? I don't get it

dittoheadadt • 1 year ago

If I use a password manager and 2FA (which I do), I don't have to type anything, so there's no thermal image to worry about. And if I'm on a public computer, I'm not gonna do anything sensitive enough to require me typing in a password, and certainly would never type my password manager Master Password on a public computer. (For example, I just logged into Disqus to post this comment, and didn't have to type anything to get in.)

Lishnakov • 1 year ago

What if you use a character multiple times in a password, would the AI still be effective in getting your password?

Mark Stockley • 1 year ago

An interesting question. I don't know, but I wonder if multiple hits creates a telltale heat signature. It seems the kind of thing that increased sensitivity in either the detector or the algorithm might overcome, even if it works now, so I'd file that under "techniques likely to stop working at an unknown time".

What I can say for sure is that while using the same character multiple times might offer an advantage, it will pale against the advantage of adding FIDO2 two-factor authentication (2FA). And if you add 2FA the incremental advantage of using tricks like using the same character multiple times is vanishingly small. Similarly, the research says that the effectiveness of the attack decreases with password length. Extra password length works everywhere, against all kinds of attacks, so it also seems like a better bet.

Hagge • 1 year ago

If you are close enough to take a thermal image of a persons keyboard after they typed in their PW you are close enough to see them type it in. Which would be easier.

Mark Stockley • 1 year ago

You are probably right in most situations. There is a lot of research that doesn't translate immediately into practical attacks, because there are easier ways to accomplish the same thing. It's a game of kicking a ball down a beach. Each bit of research builds on the last, and there are a lot of dead ends.

Happy Fellow • 1 year ago

I do a lot of typing on my keyboard so how is this done? Anyway, I seldom type one in and copy/paste instead. Of it is an ATM machine that may work, but if you don't have the card or know who the person was before you, how does that work??

Vivian • 1 year ago

I don't need to type a password, I just tap my card. At my bank or anywhere I need to type my password, I use my fingernail.