It is reasonably well established that it is possible to determine what one is typing based on keyboard sounds, and the difference between different keys (source). This provides a significant issue to anyone who wants to defend against it. The threat models that I have in mind are 1) VoIP software that is set to record audio, either where the VoIP provider does it or someone on the other end does and 2) audio recording in public places. Both seem feasible as the previously linked question has a link to open source software to implement this attack. What can be done to defend against these threats?
Not a lot in terms of practical efforts. The paper "Keyboard Acoustic Emanations" by Asonov, Agrawal gives rise to a few potential direct countermeasures:
- Using a non-mechanical keyboard, e.g. a rubber membrane keyboard. This reduces a lot of the identifying transmissible audio. Unfortunately they're not very comfortable to type on.
- Record key sounds from your keyboard and play them back continuously in a random order. Personally I think this would drive me completely insane.
- Play very loud white noise and hope you don't end up with tinnitus.
An indirect countermeasure is to not have any microphones within range. Don't use a microphone on your computer, and put your phones in some sort of soundproof container.
Ultimately, though, I suspect this threat is only applicable to cases where you're being targeted by a nation state actor, at which point, to quote James Mickens, you're still gonna be Mossad'ed upon.