Hacker News Reader

Comment by nkassis | Hacker News Reader

Solution add a feature to warm up the screen to exactly 98 degrees to avoid detection. Learned this from sneakers.

Another (cheaper?) solution would be to randomise the location of the keys each unlock attempt.

It would cause me a massive problem - I basically only remember my pattern

One of my banks does this for online PIN entry and it's amazing how much it slows you down not being able to do it via muscle memory.

Or move the location of the keys around the screen (but keep the order)

It would also make it impossible to unlock device off-sight (in the pocket) and increase chances of shoulder-surfing.

The proper solution would be let user draw some figure anywhere on the screen then OCR it.

Android -> Settings -> Lock screen -> Scramble pin layout.

If you are talking in general, hmmm yea hard, especially if it's mandatory.

I use a pattern for my unlock, and you don't even need thermal imaging - you can see the smear left on the screen by my finger.

For more sensitive areas, scramble pads are usually used. Solves a lot of security issues if you think anyone will go through much effort to get into an area.

For anyone curious like myself: https://www.identiv.com/products/physical-access/utrust-phys...

Or present a random 5 digit pin the user needs to enter before entering their personal pin. If the user has touched every button, then you get no information from that.

From the thermal photo in the article, it looks like you get the sequence based on the residual heat intensity. Re-using digits would complicate that a bit, but I don't think pressing half of the buttons randomly before entering the real code eliminates the attack vector.

A scramble-pad is a perfect solution to this issue.

But if you're not going to allow that, but you will allow impractically complicated solutions, then I think you'd be better off asking them to use their pin in a math problem. The CPU could easily choose one that didn't require remainders, to keep it mentally simple.

Sure. Just concatenate a 256-bit nonce to your PIN, calculate the SHA-512 of the concatenation, and then type the last 4 hex digits of the hash. Easy!

In my head, in less than a few seconds, I can take any PIN, calculate AES-encrypt it with a randomly chosen key, calculate the MD5, multiply the result by 65536, and then quickly type the least-significant 4 hex digits. Is that good enough?

Wouldn't this burn your fingers?

They meant 98 degrees Fahrenheit - body temperature.

98F (37C) is approx. body temperature, so of course, it wouldn't harm a human body.

The classic units of measurement problem. As an Aerospace engineer, I state the importance of using the proper units in any calculation.

Yeah valid point. I should know better having moved from a metric country (except for pool temperature for some reason) to the US ;p

downside: oil from your fingers would cause the touched zones to retain / lose heat at a different rate.

I've seen heated keypads at ATMs.

Reply on news.ycombinator.com