Yes! I have been wanting this forever. Keys are in too predictable a position
We should extend this concept of constant automatic optimization to all aspects of everyday life- for example your workplace location should physically relocate each day to an optimal location based on where each person coming in that day lives. An algorithm should tell you where to put away the dishes in your kitchen based on a constantly changing optimization algorithm, so that your dinner plates are in a different cabinet each day. Language itself should be radically redesigned daily to keep it optimal, with changelogs pushed out to be learned and memorized each morning before communicating with anyone.
Air gapping is a legitimate security technique. However, in this case the air gap would be between the ears of whoever designed it.
So look for the clean keys and try combinations from there. In a 4 digit (0-9) keypad, knowing the clean numbers drops the possible codes from 9999 to 24 (if my early morning math holds up).
Also helps the issue of someone looking over the shoulder of a valid person. Chances are they are just seeing the position and not the character pressed. So the keyboard changes and you actually need to know the character not just the old position.
It actually drops from 10^4=10000 to 4^4=256 combinations
1. You have lots of spy-data samples that reveal which physical key is pressed (perhaps they sound different) and the precise timing of those strikes, but you don't know what scrambled numbers were actually being shown. (And it's always the same code.)
2. The trick is that users take longer to press a number when it's displayed far away from its "normal" position, because they had to seek longer to find it.
3. This means you can infer the true numbers based on how quickly or slowly presses happen versus which physical key is struck.
For a simple example, assume a two-digit code where there are nine keys. If the fastest first press is always the top left corner, and the fastest second press is always the middle, we can guess the code is either 15 or a 75, depending on if the user is accustomed to phones or keyboard numpads.
One mitigation might be to get the user to enter digits at a consistent pace, by forcing a delay between showing the random layout versus accepting a button press. There would need to be some penalty for early presses, to keep lazy users from just tapping the desired button repeatedly until it became active.
Or have a keyboard with oled or e-ink keys, like the Optimus Maximus [0] promised to deliver. It's kinda weird that nobody else seems to have picked up on this concept since then. Probably just impractical or too expensive.
I read that its patents expired in 2016; around 2015 there was a concept for an e-ink button keyboard, but that site is now a plain gambling ad. There's also https://www.nemeio.com/ that still works, but its buttons look like sunken screens under plastic domes.
It also takes ~5s to render the page on my PC, no idea WTF it's doing during that time, probably mining crypto.
Hmm actually, it doesn't rearrange on every digit, it's a static but random layout every time you go to that page.
I can't help but feel like it's less secure than the default layout - I'm quite good at hiding my PIN and typing quickly, but when the positions of the numbers are randomised, I feel like I practically end up saying my PIN out loud as I try and remember it.