You commented SOUND. Here's the study behind the reel, what it did and didn't show, and every defence the researchers list.
1. The study
The paper is "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards" by Joshua Harrison (Durham University), Ehsan Toreini and Maryam Mehrnezhad (2023).
The headline results, in their words: "When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%." And: "When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved."
The Zoom recording "required no access to the victim's environment and in this case, did not require any infiltration of their device or connection."
2. How a click becomes a letter
Record. 36 keys (0-9 and a-z), "each being pressed 25 times in a row, varying in pressure and finger." The phone, an iPhone 13 mini, sat 17 cm from the laptop.
Cut. Each keystroke is isolated as its own clip, a third of a second long.
Turn it into a picture. Each clip becomes a spectrogram: "the Y axis representing frequencies and the X axis representing time. The brightness of a pixel... represents the amplitude."
Train an image model. They used CoAtNet, an image recognition model, to match each picture to its key, then tested it on presses it hadn't seen.
Its mistakes are the giveaway: "5/9 false-classifications are a single key away from the true value." The researchers read that as position "playing a large part in keystroke recognition."
3. What it did not show
One laptop: a MacBook Pro 16-inch (2021), in a lab.
Single keys, not whole passwords. There was no language model guessing words.
The authors list "an end-to-end real-world implementation" as future research.
4. Every defence in the paper
Fake keystrokes on the call. They tested white noise and fake keystroke sounds; fake keystrokes added to the transmitted audio "appears to have the best performance and least annoyance to the user."
Mute while you type. An earlier study the paper cites says "muting their microphone or not typing at all when on a Skype call may defend victims."
Random mixed-case passwords. "Randomised passwords featuring multiple cases" help, and "passwords containing full words may be at greater risk of attack."
Touch typing. In an earlier attack the paper cites, touch typing cut recognition "from 64% to 40%."
Biometrics. With fingerprint or face login, "the requirement for input of passwords via keyboard is all but eliminated."
The easy one today: use a password manager plus your laptop's fingerprint or face login, and you barely type a password on a call again.
Mike
PS: Want more like this, how the tech you use every day actually works? You're already on the list. Reply and tell me what to break down next.