Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Seems like it wouldn't be too hard to determine if someone is using all lowercase, special characters, or even the length of their password. In fact, the length might be discovered from audio only. After years of typing, I find that I type common English words much faster than random strings. Again information available from audio only.

Any studies on such?

share|improve this question
add comment

1 Answer

After a few days or weeks, you will find that your type your password much faster than just about any other sequence of letters, simply out of repeated usage. Whether the password "makes sense" in some language or not will not matter for that.

Apart from delays between keystrokes, which can be due to many factors such as the "unnaturalness" of the character sequence but also the involved movements and hand flexibility, each key is likely to emit a slightly distinctive sound. It can be done easily with a human ear for the space bar, but with some recording and computer-aided analysis you can get a lot more information. Recording is easy because any smartphone can do it (and waving around your smartphone no longer constitutes suspicious behaviour, so an attacker can get away with a lot of sneaky recording).

There is some heavy research on that subject. Some googling reveals this article, and also this PhD thesis, and this blog post, and even a previous question on security.SE.

Executive summary: audio analysis of keystrokes works. However, there does not seem to be ready-to-download software for that (for now !), although the various researchers who work on the subject do have code.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.