zlacker

I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.

>>thedoo+(OP)
I'm pretty confident that statistical analysis would give away your layout (assuming there's enough data), I wouldn't be so sure.

>>thedoo+(OP)
This is just security through obscurity. For real security, you need a cryptographically rolling keyboard layout.

>>thedoo+(OP)
At least it would have, until just now, when you recklessly disclosed your secret keyboard layout. :P

>>thedoo+(OP)
Couldn't they just translate the detected keystrokes to colemak layout?

>>thedoo+(OP)
This specific attack could also be easily mitigated by dictating your passwords instead.

>>bqmjjx+p
Brilliant suggestion. Have a TRNG or a CSPRNG (if too poor for a TRNG) choose the next layout at random for you, ideally with every keystroke. Good luck cracking that!

>>thedoo+(OP)
That's the equivalent of a shift cipher with a well known offset.

>>bqmjjx+p
Why not just a keyboard that produces random noise?

>>glitch+62
Even using Vim or Emacs would add some obufsCTRL[dbiobfuscation from all the spurious keystrokes.

>>glitch+62
Some places use touchscreen keypads for PIN entry exactly for this reason: to allow randomization, e.g. for opening a locked door, or for authorizing a transaction.

>>glitch+62
Could be done by using a device with a display - e.g. an "ereader" - to present a random keyboard layout. But, good luck being efficient typing on that. At that point, better use a different input model.

Or, use techniques such as those in the article, such as random keypresses played during the actual ones.

>>rainco+z3
Because the real data stream would still be there, just mixed with some noise. It feels harder to analyze whether the noise sufficiently obscures the real keystrokes than it does to ensure the actual keystrokes reveal no information.

>>rainco+z3
Finally, a use for Buffy's Swearing Keyboard.

Or possibly the exact opposite of that, I can't tell if it's a one-to-one mapping on mobile: https://www2.b3ta.com/buffyswear/

(Also, I'm feeling my age now, given how many years have elapsed since that kind of thing passed for internet culture…)

>>bqmjjx+p
My sister in law uses voice recognition and dictation software, so she doesn't even use a keyboard! Totally safe!

>>segfau+u4
That is interesting.

I’m sure it depends on the application to some extent. I can type my pin in without looking at all, so I can cover it up while doing it. If I had to hunt and peck, it’d easier for an onlooker to observe my slower motions I think.

But if I used the same machine often enough to produce wear specific to me, this randomization would be really useful.

>>segfau+u4
Do they randomize the key locations though?

Otherwise, you leave behind grease where your fingers touched

>>wildrh+x1
Yes but you would have to know or try all possible layout

>>8note+F8
Yes, the layout is randomized every time you use it.

>>bqmjjx+p
Whereas for practical security, having some common substring in all your passwords that you don't type but insert through some global hotkey would be just fine as a mitigation against eavesdrop attacks.

Yes, that's also obscurity, but obscurity is actually good - it only got a (deservedly) bad reputation from when it gets used as a substitute (but I fail to see how using a nonstandard keyboard layout would even count as obscurity in the context of an audio attack, as the clear text reference would surely go through the same layout?)

>>bee_ri+97
I use a randomized PIN pad on my phone, and I've gotten quite used to it. I can enter my PIN almost as fast as I could on an unscrambled pad; it's definitely not hunting and pecking.

>>bqmjjx+p
Indeed. Let me add that how your fingers come into contact with the keys is probably just as important. I recommend a cryptographically rolling choice of dustballs, crumbs, and boogers.

>>dns_sn+c
Stealing your layout.

>>mdp202+w4
Some banks went through a phase of this - website would present an on screen keyboard for the password field with a randomized layout.

I'm sure customer frustration was huge.

>>bqmjjx+p
...wait, are you telling me Konami shuffling the touch input for e-Amusement PINs[0] was a good idea!?

[0] Okay... deep breath

Konami is a pachinko manufacturer with a side hustle making rhythm games for Japanese arcades. They have an online service that all their games connect to called e-Amusement. You can log into it using an e-Amusement Pass card, and your card is locked to a PIN number you have to set up when you first use it. Cabinets with touchscreens give you a touch keypad, except all the digits are shuffled around, which is a total pain in the ass and you have to do this for every credit.

>>thedoo+(OP)
this is a targeted attack, it won't do much at all.