To keep your password safe when logging on to your computer, your instinct might be to make sure no one is watching to avoid an over-the-shoulder attack. However, a new study is showing that you may want to make sure no one is listening to your keyboard clicks, either.

Whereas internal attacks involve infiltrating a device directly often after “shoulder surfing”, side-channel attacks are based on the interpretation of a device’s information that has been externally gathered. An acoustic side-channel attack, for example, can use the sound of your keyboard clicks to figure out exactly what was typed and use that info to infiltrate your accounts from there.

And now, according to a new study, acoustic side-channel attacks present a greater threat than ever before.

To conduct the experiment, the researchers used a MacBook Pro 16-inch (2021) with 16 GB of memory and the Apple M1 Pro processor. They recorded the laptop’s keyboard clicks on both an iPhone 13 Mini that was sitting 17cm away on a microfiber cloth and Zoom’s built-in recording function on the laptop.

The researchers then trained a deep learning model using the data collected from the keystroke sound dataset. Once the model was ready, the researchers tested its accuracy using the leftover data.

The results showed that the model could identify the correct key with an accuracy of 95% from the phone recording and 93% accuracy from the Zoom recording, according to the study.

Despite the high accuracy rate of the results, the researchers identified several ways that users could mitigate being attacked, including varying user typing style, using a randomized password with multiple cases, utilizing the shift key, and playing sounds near the microphone in video calls.