Towards Inferring Mechanical Lock Combinations Using Wrist-Wearables
arxiv.org
arxiv.org
However the S&G electromechanical is direct dial, so would be susceptible. http://www.sargentandgreenleaf.com/products/electronic-locks...
However people usually open locks with their dominant hand, and wear their watch on their non-dominant hand, so it seems to be a small risk overall.
I'm more concerned about codes on keypads and passwords on keyboards being captured by cameras, either hidden spy cameras (like at ATMs) or ubiquitous security cameras that you don't even notice anymore.
Cameras are a bigger threat and I haven't seen any good novel ways to defend against that. Years ago there was an ATM pin pad that had changeable digits on each key. It shuffled the digits for each user, and you could read the digits only if you looked head on. But it didn't catch on.
These are a cheap retrofit to allow a shifting group of people to access a building. For example holiday rental properties, bedridden people with carers from agencies, outsourced building open-up/lock-up services, and suchlike.
Of course, they're already terribly insecure [2] even without this attack.
[1] https://www.screwfix.com/p/master-lock-5-key-combination-key... [2] https://www.youtube.com/watch?v=fdeMaWkJF2k
My method is not novel, but to guard against cameras and shoulder surfing when typing in a code on a keypad, I've always just covered my typing hand with my other hand.
At some banks, I've seen keypads retrofitted with raised sides, presumably to make viewing the keys from the side impossible. Your hand is still visible when you type on those, though, and so I would guess the keys that you type could be inferred from your finger motions. Anyway, the top of the keypad is not obstructed (so that the user can see it themselves), so a camera from above or someone from behind might still directly see what keys you type, so I still cover my typing hand with my other hand even when using these types of keypads.
Cool demo, I guess.