Cfrgtkky

I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting to see trends which indicate always-on cameras may become commonplace in other devices like glasses.

It has occurred to me, when out in public and entering my username/password into apps on my phone and laptop, that if a camera could capture both my screen and my keyboard, it could be fairly straightforward for a viewer to grab or guess my credentials from the footage assuming a high enough resolution image and the view not being (too) obscured.

Without going too much into the details of how it would be implemented, the accuracy and cost etc, I have a background in image processing and so am also aware that this would likely be automatable to at least some degree.

So I thought I would ask the community here if this is actually a viable risk? Have there been any known instances of it happening already? Are people thinking about this with respect to the viability of plaintext credential entry into apps in the long run?

Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.

Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.

And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.

I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.

So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.

The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.

As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)

Hidden camera behind ATM faceplate (source)

Hidden camera glued to corner of ATM (source)

Hidden camera on fake panel of ATM (source)

So yes, it is a very real-world concern.

Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.

I would say yes, and high resolution imagery is not necessary. Speaking as a statistician, I don't even need to know the exact letter or numeral you touched (on a screen keyboard or regular keyboard), reducing each choice to 2 or 3 possible characters, based on the position of your fingers, makes an electronic guess of your password a tractable problem. Especially I would try likely combinations of letters that form word fragments; e.g. ([FR][EW][DE])="FEE", "FED", or "RED".

Or if numbers, I'd look for combinations that appear in numbers related to you: birthdays, anniversaries, for you, spouse, kids. Your phone number or house address.

On a screen or a real keyboard, I can see when you shift for special characters and guess what they are. And sometimes it is clear which key you hit, depending on the angle of the camera, narrowing some position to exactly one key. The camera can narrow the field of possible passwords considerably, and often in analysis that scores how well passwords match words and dates, the "right" password can be at the top of the scoring list.

For this reason, acronymic phrases can help defeat this. The idea is to memorize a phrase that means something to you, like "If the Seahawks win the championship I'll get drunk and dance a jig." Then make an Acronym: "ITSWTCIGDADAJ". You can teach yourself to replace some of these letters with numerals or special characters.

Without knowing the phrase in your mind, the password letters are random and uncorrelated, so unless the camera can tell which keys you hit exactly, it still won't be able to guess at the correct sequence by looking for matches to real words or dates.

Yes, and this is one of many reasons that you should not be entering passwords, and for the most part should not even know your passwords, except for a password manager master password and device unlock codes/FDE passphrases. For FDE passphrases, you should enter them only when powering on the device, and only in private locations where there are no cameras or observers present.