this post was submitted on 08 Sep 2023
51 points (76.8% liked)

Privacy

39938 readers
177 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

I aways wondered if the communication channel between my wireless keyboard and the usb receiver-antena is secure. I never bother to reseach this. Today I figured out the practical way. I turned on my pc at work and I tried to type the first letter of my password. Nothing hapened. Then I started spamming that letter. Still nothing, until the person next to me said "my keyboard is typing all by itself". It turns out she has a wireless mouse with a seemigly identical receiver-antena usb.

The moral of the story. If it was so easy to almost leak my password unintentionally due to this flaw of wireless keyboard communication, imagine wad a bad actor can do intentionally. Why try to brute force, social engineer e.t.c. when your password can be stollen in transit from your keyboard to your pc.

all 33 comments
sorted by: hot top controversial new old
[–] Kissaki@feddit.de 76 points 2 years ago

Bluetooth data transmission is encrypted. Initialization typically happens only through the press of a physical button.

I assume you're using wireless devices of the same manufacturer, that uses an alternative that is not Bluetooth, and has automatic pairing without a safeguard.

This is not about wireless primarily. Use a decent product and standard and you don't have that issue.

[–] mctoasterson@reddthat.com 8 points 2 years ago

Still using a PS/2 keyboard from like 2007. Checkmate.

[–] Phanatik@kbin.social 6 points 2 years ago

My Wireless keyboard is a Keychron. It doesn't have a dedicated adapter, it'll connect to any device with Bluetooth capabilities. From what I've seen of how it works, is that it can store up to 3 device signatures to automatically connect to (you can choose which of the three is active). What I assume it's storing is the MAC address which I thought is unique to the device.

[–] RovingFox@infosec.pub 6 points 2 years ago (2 children)

All my passwords are random characters and I just copy/paste out of bitwarden. Can't leak that with a wireless keyboard.

[–] Valmond@kbin.social 2 points 2 years ago (1 children)

Does that work for logging in?

[–] RovingFox@infosec.pub 1 points 2 years ago (1 children)

I only log in on my own devices. On devices that I don't own, I change the password afterwards.

[–] pjhenry1216@kbin.social 3 points 2 years ago (1 children)

I think they mean logging into the device itself. Like, if you have a computer at work with a work login, etc.

[–] RovingFox@infosec.pub 1 points 2 years ago

Fair enough, that is a bit complicated. Thank you for clarification.

[–] library_napper@monyet.cc 1 points 2 years ago

So what you're saying is that the password to get all your passwords from the cloud is typed onto a wireless keyboard?

[–] vox@sopuli.xyz 5 points 2 years ago* (last edited 2 years ago) (1 children)

do you have one with 2.4ghz receiver?
like one of the plug and connect; no pairing required ones?
yeah these are garbage...

[–] black_mouflon@beehaw.org 2 points 2 years ago

It was indeed a 2.4 Ghz one.

[–] alp@lemmy.blahaj.zone 5 points 2 years ago (1 children)

Lol my closest neighbor is half a mile away checkmate

[–] library_napper@monyet.cc 8 points 2 years ago (1 children)

Pay no attention to that unmarked van

[–] this_1_is_mine@lemmy.ml 2 points 2 years ago

Can-tenna yaggi omni bi-focal ... satellite dish made into a bigass reflector collector. I'll get you from well down the street.

[–] RobotToaster@infosec.pub 5 points 2 years ago (1 children)

I guess being old fashioned and sticking with my model M has it's advantages.

[–] library_napper@monyet.cc 2 points 2 years ago

The guy sitting next to you hates you

[–] akulium@feddit.de 4 points 2 years ago

It is also problematic that you can send keypresses to the other person, especially since she was only using the receiver for a mouse.

[–] Zellith@kbin.social 3 points 2 years ago* (last edited 2 years ago) (2 children)

I don't use wireless because batteries suck to deal with. I learned that in my teens with a wireless headset, wireless mouse and wireless keyboard!

[–] vrojak@kbin.social 5 points 2 years ago

I don't know how old you are, but I used to think the same thing in my teens, however nowadays wireless nice last pretty long on a single charge. Mine lasts about 3 months, and in endurance mode like half a year.

[–] mishimaenjoyer@kbin.social 5 points 2 years ago

modern (bt) devices usually have a built in battery that can be recharged via cable (or use the cable to connect the device to it's computer), so that issue is off the table, at least for better devices.

[–] Doll_Tow_Jet-ski@kbin.social 2 points 2 years ago (1 children)

Shit my current computer only works with wireless keyboard...Although I guess I could get a regular one and use one of the USB ports. Good to know, thanks.

[–] Successful_Try543@feddit.de 2 points 2 years ago (1 children)

If the keyboard is connected via Bluetooth, it should be quite secure.

[–] Doll_Tow_Jet-ski@kbin.social 1 points 2 years ago (1 children)

It's connected via wireless USB.

[–] Successful_Try543@feddit.de 2 points 2 years ago* (last edited 2 years ago) (1 children)

According to Wikipedia, wireless USB should be secure too: "The goal of the specification was to preserve the functional model of USB, based on intelligent hosts and behaviorally simple devices, while allowing it to operate in a wireless environment and keeping security on a par with the levels offered by traditional wired systems."

[–] Doll_Tow_Jet-ski@kbin.social 2 points 2 years ago

Phew. Thanks for doing the research and sharing the info

[–] sirico@feddit.uk 1 points 2 years ago

Don't use cheap ones with white label components. Sender and receiver having a shared key would resolve this.

[–] humanenough@lemm.ee 0 points 2 years ago