Seems like it wouldn't be too hard to determine if someone is using all lowercase, special characters, or even the length of their password. In fact, the length might be discovered from audio only. After years of typing, I find that I type common English words much faster than random strings. Again information available from audio only.

Any studies on such?


After a few days or weeks, you will find that your type your password much faster than just about any other sequence of letters, simply out of repeated usage. Whether the password "makes sense" in some language or not will not matter for that.

Apart from delays between keystrokes, which can be due to many factors such as the "unnaturalness" of the character sequence but also the involved movements and hand flexibility, each key is likely to emit a slightly distinctive sound. It can be done easily with a human ear for the space bar, but with some recording and computer-aided analysis you can get a lot more information. Recording is easy because any smartphone can do it (and waving around your smartphone no longer constitutes suspicious behaviour, so an attacker can get away with a lot of sneaky recording).

There is some heavy research on that subject. Some googling reveals this article, and also this PhD thesis, and this blog post, and even a previous question on security.SE.

Executive summary: audio analysis of keystrokes works. However, there does not seem to be ready-to-download software for that (for now !), although the various researchers who work on the subject do have code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.