Google Glass Snoopers Can Steal Your Passcode With a Glance

http://www.wired.com/2014/06/google-glass-snoopers-can-steal-your-passcode-with-a-glance/

by balbaugh • 12 years ago

35 50 12 years ago

ryanmcbride3• 12 years ago

It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away.

I hope this makes a push for more/better biometric locks on every day devices.

sanswork• 12 years ago

Biometrics are just passwords you can never change. In "something you know, something you have" the second probably shouldn't be something you can never change if compromised.

dublinben3• 12 years ago

Fingerprints are also one of the most promiscuous of biometric indicators possible. You leave your fingerprints just about everywhere you go, which can be picked up with some powder and sticky tape.

I would never consider my fingerprint to be a secure form of identification, nor should systems be designed that make this assumption.

ryanmcbride3• 12 years ago

That's a good point. But while it's permanent it's at least harder to replicate for the time being.

enraged_camel2• 12 years ago

>It seems like any video enabled device can steal your passcode if it sees you enter it. The phone they used did even better in glass from 10 feet away.

The difference is that when you record someone with a non-wearable device, it's pretty obvious. In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity) if they are paying attention.

With Glass though, who knows if you are recording or not? AFAIK there isn't a red "recording" light that comes on, right? So as far as people are concerned, you might just be casually glancing in their direction, except you aren't.

raldi• 12 years ago

In the phone example, you have to hold it up a certain way, which will immediately alert the target (as well as anyone in the vicinity)

That's not really true. It's very easy to take a picture while holding the phone in a way that makes it look as if you're just reading it.

codeka• 12 years ago

From the article, they were able to capture the PIN code from across the street and two stories up using a camcorder. You're not even going see that person.

personZ• 12 years ago

With Glass though, who knows if you are recording or not?

Without Glass, who knows if you are recording or not.

The hysterics (largely driven through anti-Google rhetoric, fwiw. People like Gruber are on the front-lines of anti-Glass hate) seem naively simplistic. In this case, there are people stealing your pin codes, and they do it in bulk, using tiny, concealed video devices that you never knew were there.

And as for everyone else, any of them, and any of your environments, can be absolutely coated with surveillance devices. High capacity, very tiny cameras are literally low-single digit prices now.

Singling out Google glass users is luddism that uses it as an easy bully victim in hopes that it makes technology suddenly regress. Only technology is long past it.

Oletros2• 12 years ago

AFAIK there isn't a red "recording" light that comes on, right?

Yes, there is

kator• 12 years ago

Funny I've always worried about the mobile keypads because on top of that they "echo" the character you typed. I'm paranoid and often try to shield the screen when I type in my password. That said there are so many cameras everywhere it's hard not to think that somewhere they got a good clean shot and could figure out my password.

I don't use the same password on any two things so it's less useful to get my mobile lock password then it might be for some but if you have a lock screen pin or password you do get an amazing amount of stuff for free on a person's mobile device...

uses• 12 years ago

I'm not sure what I expected from comments on Wired, but that is pretty amazing that all the most highly-upvoted comments are calling Glass users "glassholes", pedophiles, and encouraging violence against them and/or their Glass devices.

fletchowns• 12 years ago

To be fair I've heard these same kind of comments in real life about Google Glass users.

esbonsa3• 12 years ago

hopefully they are consistent and have the same comments about anyone having their phone out of their pocket

esbonsa3• 12 years ago

Can someone explain why "phones" should not be considered a treat to privacy if you think Google Glass is?

gress5• 12 years ago

Is it really so amazing that people care about their privacy?

lvs• 12 years ago

You know what else can steal your passcode with a glance? My eyeballs.

CanSpice• 12 years ago

From 44 meters away?

enraged_camel2• 12 years ago

Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information. Not only that, you can also be recording the person, and can later look up their face, potentially figure out their identity, and then proceed with identity theft.

You can't do that with just your eyeballs.

dragonwriter2• 12 years ago

Yeah, but there is something to be said about Glass making it possible (and trivial) to record the sensitive information.

Google glass didn't make that possible, the invention of the video camera did. Plenty of those around -- often in compact form -- with or without Glass.

techwizrd• 12 years ago

The comments in the Wired article are pretty ridiculous and it seems as if the article title is pretty sensational. The article also mentions that a Samsung smartwatch is just as accurate and an iPhone 5 camera caught the PIN every time. According to the article, a person with a $700 Panasonic camcorder can steal your PIN from 4 stories up and across the street. You don't, however, see any of the commenters in the article calling people with camcorders pedophiles and asking for them to beaten up. The hysteria is ridiculous.

I think the solution given by the article researchers that randomizes the locations of the numbers on the PIN entry is a much more effective solution than wantonly destroying people's property or assaulting them because of a perceived, imaginary threat.

mikecb• 12 years ago

Unfortunately, randomizing the button locations would be an accessibility nightmare.

dublinben3• 12 years ago

Security and accessibility are pretty much inherently opposed.

CSDude2• 12 years ago

It is a standard for many banks in Turkey, since we only enter PIN

ryanmcbride3• 12 years ago

Runescape's been doing it for years.

lstamour2• 12 years ago

Not if you can move your finger and listen for the number via VoiceOver. And if it's not on by default. That said, I wonder if one could make a tap pattern password for blind folks and finger drummers ;-)

lstamour2• 12 years ago

If I can use a custom keyboard to enter my iPad pin code -- problem solved? I'd of course point out that the pin code is the least of your worries given most apps' security when on unsecured wifi... Besides, this really is nothing new, as people have been remotely stealing PIN numbers for ages, even recruiting others to do it for them. That this is an iPad instead of a PIN pad doesn't make much difference.

That all said, I'm sure more people will buy into fingerprint passwords from articles like this ... which is just as insecure, someone can easily get your prints if they wanted to. Perhaps we need a bluetooth Yubikey plus manual entry for 2FA ;-)

thegeomaster• 12 years ago

Randomizing the locations can help, but if the camera sees your display, you're screwed anyway. I guess you just need to be more careful about others' lines of sight when you're entering sensitive data. Someone may be spying over your shoulder, as well.

Regarding the comments: they may seem ridiculous after you've been browsing HN and reading the comments on here. The kind of discussion on that Wired article is not any worse than your average Internet discussion, it's just that HN raises your bar because it targets a narrower demographic. Such niche communities tend to have the most sane behavior of users; on the other end is 4chan's Random board where "everything goes", and look at it, it's the asshole of the Internet.

rbanffy• 12 years ago

We'll have to adjust to a world where everyone has perfect visual memory and superhuman time perception.

schoen2• 12 years ago

This brings to mind the plot of Isaac Asimov's story "Lest We Remember".

https://en.wikipedia.org/wiki/Lest_We_Remember

That title was also the inspiration for the title of a paper I worked on:

https://citp.princeton.edu/research/memory/

lugg• 12 years ago

“I think of this as a kind of alert about Google Glass, smartwatches, all these devices,”

Why is it that its always a fault with the new tech? I'm not a glass esplorer but still I take offense to this kind of idiocy. The problem is with passcodes/passwords in general, they have always been susceptible to this kind of attack, adding in a video recorder doesn't change this.

daenz• 12 years ago

Seems like an easy solution: randomize the PIN keypad layout with every key press.

TOMDM• 12 years ago

If you wanted to take it a step further, the touch screen could have a very narrow viewing angle, have the angle of the screen automatically or manually rotate to the users eye level, and then someone standing next to you would just see a blank screen. With random keys on top of that, someone would literally have to poke their head over your shoulder to see.

snogglethorpe• 12 years ago

If they're going to do that, they need to do it consistently...

Most ATMs around here don't randomize the layout, but every once in a while I come across one that does, and I've found that it's actually quite difficult to use the latter. Apparently I have my PIN memorized mainly through muscle memory... when using the randomized sort I've occasionally resorted to drawing a keyboard and looking at what numbers my fingers hit! ><

CSDude2• 12 years ago

Another anti-Google propoganda with highly offensive comments (pedophile, glasshole etc.) with high upvotes and not a single downvote.

You can do the exact same thing by hiding a camera in anywhere your body, and they won't even be spotted like Google Glass. There are cameras as tiny as: http://youtu.be/CgtTg62GDfs?t=2m19s and I'm sure many intelligency agencies around the world have better cameras than this on their agents, and some one might be actually using them. Additionally, almost all the stores has security cameras, which are on top of you and potentially can do the same thing, and you won't even notice.

gress5• 12 years ago

Which giant corporation is trying to popularize the daily use of these other cameras?

gbog2• 12 years ago

You mean a big startup creating new projects in many different directions, automated cars, wifi balloons, space elevator, open source os for mobile devices, and smart spectacles?

megablast• 12 years ago

And more pro Google propaganda, that seems to popup whenever anyone criticizes google glasses.

Even now, I would suggest there are more google glass wearers than people with hidden cameras.

userbinator• 12 years ago

I think it's a little odd that screens on personal devices are going in the direction of super-high viewing angles and brightness, as if letting everyone else besides you see what you're doing is a good thing... even the unbranded low-end Android I have has a screen with nearly 180 degrees of viewing angle.

However, this with a randomised button layout solve the problem quite well:

http://solutions.3m.com/wps/portal/3M/en_US/SDP_NaturalView/...

gbog2• 12 years ago

It is weird to not see a single comment calling for the long due death of passwords as authentication.

They have so many drawbacks, they are annoying each and every employee that works with a computer on earth, we have weekly massive password leakage posts on HN (only tip of the iceberg), and apart from fingerprints there is no contender?

Guys, startup creators, hackers, engineers: wake up! Find something, anything!

In 30 years, when passwords will be past, our future selves will be amazed to read stories about passwords: how could we bear this skyscraping level of stupidity and annoyance.

Google Glass Snoopers Can Steal Your Passcode With a Glance

Related Stories