this post was submitted on 02 Dec 2023
436 points (95.8% liked)
Technology
60079 readers
3381 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The article says
Hm. Sounds like "some cases" are hunt and peck typists or very slow touch typists.
I don't know if training for each victim's typing is really needed. I get the impression they were identifying unique sounds and converting that to the correct letters. I only skimmed and I didn't quite understand the description of the mechanisms. Something about deep learning and convolution or...? I think they also said they didn't use a language model so I could be wrong.
The problems is that even with up to 95% accuracy that still means the with a password length of 10 there is a 50/50 chance that one character is wrong.
A password with one character wrong is just as useless as randomly typing.
Which character is wrong and what should it be? You only have 2 or 3 more guess till most systems will lock the account.
This is an interesting academic exercise but there are much better and easier ways to gain access to passwords and systems.
The world is not a bond movie.
Deploying social engineering is much easier than this sort of attack.
"Hearing" the same password twice drastically increases the accuracy, however, social engineering is indeed the most effective and efficient attack method.
If the password is not random, as they seldomly are, you can just guess the last, or even the last few characters of they are not correct.
Have you never seen a Bond movie? Yeah they always have a gadget or two, but the rest is basically him social engineering his way through the film. And shooting. Usually lots of shooting too.
I was thinking of this attack in terms of grabbing emails, documents, stuff like that. Or snippets thereof.
I imagine it probably also uses an algorithm to attempt to "guess" the next letter (or the full word itself, like your phone keyboard does) based on existing words. Then maybe an LLM can determine which of the potential words are the most likely being typed based on the context.
I dunno if that makes any sense, but that's how I pictured it working in my brain movies.