Does the iOS 10 keyboard click sound divulge too much?

Question

The updated keyboard in iOS 10 has at least three distinct "click" sounds that I'm aware of: a high click upon entry of any normal character; a mid-range click when entering a space, toggling shift, or switching between the ABC, 123, and #+= layouts; and a low click for each backspace. Compare this with iOS 9, which had one click sound that played for each keypress, regardless of what it was.

The first time I entered a password using this keyboard, I found it a little disconcerting that the phone was audibly broadcasting more detail about the state of the keyboard than I'd personally prefer. But the more I think about it, the more difficulty I have trying to envision an attack that can make use of this information in a practical way.

Am I being too paranoid in thinking that an audio recording of an iOS 10 password entry reveals significantly more detail than the same entry on iOS 9? Does this change reduce, by any useful amount, the effort required for a theoretical adversary to discover a password?

Answer 1

While similar to old fashioned shoulder surfing, this attack has some severe limitations:

• You need physical proximity - you need to hear the tapping sounds. That means it can not be automated.
• While you do decrease the entropy of the password you do not get the full password. For this to be useful you would need some more information - e.g. a leaked hash (that is now faster to crack since you can narrow down the dictionary) or an other password that this is believed to be a variant off (like password1 instead of just password).

Because of these two limitations I can only see two reasonable scenarios:

• For extremely high value targets, sending out someone listening for tap sounds might be worth the effort. But nobody reading this is that interesting...
• It could potentially be used by a significant other or someone else close who already knows some of the passwords the victim use, and does not need excuses to be in listening range.

In conclusion I am with Apple on this one. The increased usability probably outweight the tiny loss of security. If it bothers you, you can always turn of the tap sound completely. But that is not a security advice I would bother giving to an ordinary user.

And do note that even the old tapping sound would let a listener deduce the length of the password.

(On second thought, they could have deactivated the different sounds for password fields, and keep them for everything else. That would have been better. But I would not loose any sleep over it.)

Answer 2

If someone has a really good and valuable reason to be targeting you, they could use this to narrow down a brute force/mask attack.

For normal people, the chances that a password cracker (working for profit) will physically find you and your phone in the real world, be able to listen CLOSELY to you typing in your password AND have your password hash are infinitesimal.

If someone has a real reason to go though a lot of digging just to get YOU, making a seriously large amount of money - more than they'd make cracking someone else's password which is likely to be "12345" and takes less than a minute to crack on a Commodore 64, meaning that they know you're more valuable than the 1234 blonde; you should just turn the key sound off on your phone.

However, if you are this person, you probably already turned the key sound off in iOS9 so nobody could tell how long your password was.

The technical answer is that yes: the loss of security from this is real:

Say your password is "&Passw0rd5"

With iOS9 I would only know your password was 10 characters long (which is way too short but I'm just using for this example to illustrate my point). I would have to assume that you used all 4 ASCII "categories" (uppercase, lowercase, numbers and symbols). This would make your password:

95^10 = 5.98736939E+19 possibles

A seriously badass password cracking computer will check up to 350 billion hashes per second, so this will take slightly less than 5.5 years to crack with brute force (dictionary and other attacks, much faster but that's not the point of the example).

If I had a recording of you typing in you password in iOS10, I would be able to do a mask attack and bring the possibles down to 3.28982945E+15. Which, with the same computer, I could crack this in about 5 hours.

So, there is a very real potential loss of security, but my example assumes:

1. You have a very short, weak password that is protecting something very valuable. If your password was 25 characters and very strong, it world still be completely unfeasible to crack it even with this information.
2. A seriously pro password cracker wants your password.
3. He's gotten the hash of your password and
4. He's also found you and was able to be close enough to you to perfectly get the pattern of your password from the sound.

If #1 applies to you, for God's sake, get a secure password. Otherwise, if you're worth going through all the above for, turn the key sound off on your phone and be nice to your private security team so they don't sell you out.

Glad to be of service Mr. President.

If your a normal person, enjoy that cool new feature on your iPhone that will make typing that much more fun.