AI can steal your passwords just by listening to your typing
Researchers just built an AI system that can identify which keys you press on a laptop simply by eavesdropping on typing sounds. The model hit 95% accuracy using a nearby phone recording and 93% over a Zoom call. Why it matters: as microphones become ubiquitous, typing sensitive passwords during video meetings is turning into a genuine cybersecurity hazard.
Typing out a password while chatting on a Zoom call might be a lot riskier than you think.
A team of researchers from Durham University, the University of Surrey, and Royal Holloway, University of London, just revealed that artificial intelligence can figure out what you are typing simply by listening to the sound of your keystrokes.
Eavesdropping through Zoom with 93% accuracy
The setup for the experiment was surprisingly simple. Researchers took a standard MacBook Pro and pressed 36 individual keys, including all letters and numbers, 25 times each using different fingers and varying pressure.
They recorded the typing sounds through two common channels: a smartphone placed nearby and a regular Zoom video call.
After feeding portions of the acoustic signals into a machine learning model, the system learned the subtle acoustic differences of each key. According to lead author Joshua Harrison from Durham University, the sound profile is heavily influenced by how close a key is to the edge of the laptop casing.
When tested on the remaining recordings, the AI achieved 95% accuracy in identifying keystrokes recorded by the phone, and an impressive 93% accuracy over the Zoom call.
University of Warwick professor Feng Hao added another layer of concern, noting that subtle movements of a person's shoulders and wrists on camera can also give away keystrokes, even if the keyboard itself is hidden from view.
How to defend your keyboard
To be fair, the researchers emphasize that this is a proof-of-principle study. Translating single-key sound recognition into cracking full passwords in a noisy coffee shop is a much harder task.
Still, defending against these acoustic side-channel attacks does not require fancy hardware.
The authors recommend relying on biometric logins like Touch ID, turning on two-factor authentication, or simply using password managers to autofill credentials.
If you have to type, Harrison suggests mixing upper and lower case letters using the Shift key, because audio models have a tough time detecting when someone actually lets go of the Shift key.
Why it matters
We think this study is a sharp wake-up call for remote work hygiene. Millions of people routinely type while unmuted on calls, assuming that standard audio compression strips out any usable data. This paper proves that commodity microphones and basic video conference feeds carry far more information than most people assume.
While everyday users do not need to panic about immediate password theft, it does change the security baseline. The barrier to pulling off side-channel eavesdropping is dropping fast thanks to modern machine learning. In our view, the ball is now in the court of video conferencing software, which may soon need to treat keyboard acoustics not just as annoying background noise to suppress, but as sensitive biometric data to scramble.
Sources (1)
- theguardian.com(opens in a new tab)Originaltheguardian.com