Even long, complex passwords aren’t safe from being cracked now that researchers have created a new system that pairs thermal cameras with AI to figure them out.
As reported by our sister site Tom’s Hardware, researchers at the University of Glasgow in Scotland have published a new paper detailing their ThermoSecure system that can figure out passwords based on key presses and taps on a smartphone’s screen.
As the name suggests, ThermoSecure uses thermal imaging cameras and AI to figure out 6-symbol, 8-symbol, 12-symbol and even 16-symbol passwords. The system’s accuracy depends on the length of a password but so far, it’s off to a good start.
During testing, ThermoSecure had an accuracy rate of 92% with 6-symbol passwords, 80% with 8-symbol passwords, 71% with 12-symbol passwords and 55% with 16-symbol passwords. The accuracy of the system can be improved though by taking thermal images within 30 seconds of a user entering their password.
The components used to build the researcher’s ThermoSecure system are relatively inexpensive and a $150 thermal camera could be used to achieve similar results. However, the researchers also paired the camera with an object detection technique based on Mask RCNN. While the thermal camera takes the pictures, the AI basically maps the thermal images they produce to the keys on a physical keyboard or even one on a smartphone.
How to protect your passwords from being cracked
Fortunately, ThermoSecure is a system that was developed by researchers and not hackers. Unless it falls into the wrong hands, it likely isn’t something you’ll need to worry about. Still though, now that the research has been published, hackers could try to reverse engineer ThermoSecure.
For that reason, there are several steps you can take now to protect yourself and your passwords. For starters, by using one of the best password managers, you won’t have to physically enter passwords. Instead, a password manager like 1Password or Dashlane uses autofill to enter them for you automatically.
At the same time, the way in which you enter your passwords could make them more difficult to crack by ThermoSecure or a similar system. In their paper, the researchers from the University of Glasgow note: "Users who are hunt-and-peck typists are particularly vulnerable to thermal attacks." This means that you can protect yourself by improving your typing speed, which may be easier with one of the best mechanical keyboards. Likewise, backlit keyboards can help disguise the heat traces from your fingertips after typing out one of your passwords.
If you’re really worried though, you should consider going passwordless instead. By using biometric authentication, a physical security key or even passkeys, you can improve your overall security posture and lower your chances of getting hacked.
At the end of the day, ThermoSecure is a research project and not an actual product sold on the dark web to hackers by other cybercriminals. Instead of being a pressing threat, it’s just one that you need to look out for in the future, especially as AI becomes more advanced.
