Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No only a keylogger, but a "soundlogger" would also work.

Checking long posts on news sites or blogs just to make sure it is the writer would be interesting, but boring and not worth it.



For interesting research here, see: Keyboard Acoustic Emanations Revisited, Li Zhuang, Feng Zhou, J. D. Tygar

http://www.cs.berkeley.edu/~tygar/keyboard.htm

    "We examine the problem of keyboard acoustic emanations.
    We present a novel attack taking as input a 10-minute sound recording of a user
    typing English text using a keyboard, and then recover- ing up to 96% of typed
    characters. There is no need for a labeled training recording. Moreover the
    recognizer bootstrapped this way can even recognize random text such as
    passwords: In our experi- ments, 90% of 5-character random passwords using only
    letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-
    character passwords can be generated in fewer than 75 attempts.


Now that would be magical - visit a website and start making comments, after a period of time it'd create an account for you with no input at all.

Now, visit it from a different browser or computer and make another comment - it would log you in as you again, somehow.

Errors would likely make it unpractical, but it'd be an amusing demo for the unaware.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: