Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Question

Is it a bad idea to post a photo of your keyboard to social media?

Can I look at a photo of a keyboard and determine the password of an account?

Assuming a certain (set of) password(s) is the most commonly typed character sequence on a given keyboard:

• Is the resolution in the photo of that keyboard sufficient to determine the most frequently used set of keys, by analyzing the grease patterns on them?

• If I know the most frequently used keys, is a brute force attack now feasible, since I can limit the size of the dictionary?

This question is inspired by a time I saw a door protected by a numeric keypad, where the paint was missing on three of the keys. The room number was three digits, none of which had paint on their respective keys. Unsurprisingly, the combination was the room number reversed.

Answer 1

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded.

And one special key being significantly more used than the others - unless it's "{", "}" or ";" and you happen to be a programmer - could allow to include that in a bruteforcing, or exclude others (this is definitely NOT my keyboard, but still):

But most people don't use the keyboard for just their passwords, and the wear pattern is also influenced by the stroke direction, angle and pressure - keys farther down the keyboard will be pressed differently from those nearer. The keys I wear faster appear to be exactly under the hand that controls them, and now that I noticed, I hit them harder than the rest (OK, also I'm a horrible typist).

The keyboard might hint (weakly, at that) at what the most frequent typed word, or anagrams thereof, might be. But that's not the same as your password except in very specific cases (e.g. an entry keypad).

In even more specific cases such as heat-conducting entry keypad, FIR or strong UV picture taken immediately after typing so that residual heat or fluorescence or phase interference from skin oils may be appreciated, you might be able to get something. But an ordinary picture conveys no such information.

So my opinion would be that keyboard pictures are mostly harmless.

On the other hand, I sometimes see Post-It with letters and numbers on them attached to monitors and on woodboards behind selfied people, so I'd also say that it's always a very good idea to review the photos (as well as whatever else) you post to the social media, looking at the goods with an attacker's eye:

• inside view of (broken/defective/jimmied?) locks and/or brand names useful to research approaches
• hints about location (this might be relevant to determine whether you're holidaying abroad, and estimate how long your home will be vacant)
• valuable items (might give people ideas either about them, or about your wealth, which also could give people ideas)
• discrepancies between what's shown and what you told anybody who might get to know, such as employer, insurance company, significant other(s), etc.

At least once, some months after this answer was posted, the last case actually happened.

Answer 2

There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But you can argue this by saying that there are special characters on your keyboard which may be included in your credentials, because normally we don’t use those characters much in day-to-day work. So you better have a look at your keyboard before you post pics on social media :)

Answer 3

Only if the sole purpose of the keyboard is to type one password.

Otherwise, you'll find that more frequently used keys such as vowels, WASD, and modifiers will also have oil stains and signs of wear. It becomes especially more difficult if the password is a passphrase containing natural language.

Answer 4

The biggest difference is in scale. A keypad on a lock is generally only used to type the password, so the password keys are the only ones being used and worn. "Any given keyboard" is generally used for much more than only typing passwords.

There are many other attacks used on keypads: video cameras watch you enter your pin, heat sensing (flir), or even using fingerprint powder to see the most used keys. (Thanks Brian Brushwood)

I battle this by using my first three fingers to cover the entire row of numbers, and I go through and touch every key, regardless if it's in the combo.

Answer 5

You need to clarify the term "keyboard". If you take a pic of my keyboard I am writing this text. You will surely notice some patterns and missing letters from my typing. But be aware that most of the time such keyboards are not used to enter passwords at all. Typically you rather get a heat map of the frequently used chars for a certain natural language. E.g. my a, c, e and n are no longer visible.

I thought about my passwords. When I use natural language to form complex words in it, I of course tend to use the most common chars for my language. When I use or am forced to use special chars, etc. they get hardly used in other scenarios.

Now since you are talking about security keyboards, whose purpose is entering a password the answer is "maybe". If many people use one single password all over, then of course the patterns will be visible over time and it should be possible to create permutations of the used digits or chars. How ever, if many people use different passwords on this keyboard you will again only see the patterns of the frequently used digits or chars.

This will reduce the search space, but may be not enough to actually get the password as there may be other means of protection, e.g. locking the lock after n failed attempts.

Answer 6

I think it would be possible to somewhat significantly reduce the search set, but it largely depends on the resolution of the picture and the worn state of the keyboard. With a visibly worn or dirty keyboard (dirt on the edge of keys could serve the same purpose), you would first establish the possible alphabet, with each key weighted at 1.0. Then establish a baseline. Analyze LOTS of photos of keyboards for which you already know the password to, and weight the globally most used keys for a specific culture lower than the rest. This process will reduce vowels weight for example. Then reduce the alphabet by removing the least used keys (since a password is likely to be typed in relatively often), and prepare a dictionary with the keys you have left.

All this is pretty pointless however, there are much easier ways to hack someone than bruteforcing their password. So long as you use a relatively long password (8+ chars) and include symbols, upper and lower case, and numbers, there is very little chance someone will obtain your password by bruteforcing it.

Answer 7

Keyboards wise, I'd consider this a minor concern unless I was using the same password for everything. If you're using a different password for everything and changing them reasonably regularly, you're probably fine. Add this to the fact that if you're using the keypad for other things you're going to get a much different wear pattern than just P A S W O R D being worn, you've probably not much to worry about.

If like me you're an avid FPS player, (and unlike me you've got one password for everything) by the time wear is visible on the password keys, your WSAD keys are going to be worn as well, you're probably ok.

That said, change your passwords regularly and use a random generator to create memorable random passwords. The Dice PassPhrase Generator is a good place to start. With a bit of excel wizardry you can create your own password generator based off these principals and presto - memorable random passwords.