But he says the research is only intended to show the possibility of the spying technique, not to perfect it. “We’re security experts, not speech recognition experts,” Boneh says.
It shows. Sampling at 200Hz means your masimum detectable frequency is 100Hz, per the Nyquist theorem - that'll capture ~40% of the typical male frequency range (fundamental only - not enough for harmonics or formants) and little or nothing of the typical female frequency range. I question the claimed 65% success rate, and would like to know a lot more about the experimental conditions before I'd be inclined to accept it. I do enough synthesis to know what that sort of sample rate sounds like without having to test, and the short answer is 'awful'. I can see possibly getting numbers out of it when the phone is held up to one's head but only in perfectly controlled environments. For contrast POTS bandwidth is 300 to 3400 Hz.
Or if an app really needed to access the gyroscope at high frequencies, it could be forced to ask permission. “There’s no reason a video game needs to access it 200 times a second,” says Boneh.
I think it's quite plausible that people might be able to detect a lag greater than 5ms in the right game. That's around the envelope for involuntary variation by professional drummers.
That is what one would get with a single gyroscope. Now imagine several gyroscopes listening in, with their sampling frequency slightly/randomly out of phase, an array of receivers if you will. For this to work one needs to figure out the 'sync' of the gyroscopes but I dont see a fundamental problem with this approach.
I don't know, requiring several phones within hearing range seems like it would severely limit the applicability of this technique.
If you think N phones provides at best N*(maximum sample rate of one phone) and that's assuming their phases a perfectly misaligned I'd think you'd still need quite a few to get something.
Plus the 100 Hz figure is optimistic. I dunno what kind of anti-aliasing these things have. If none you get an aliased signal and with a low order filter the practical maximum frequency detectable would be even less.
Reminds me of the recent Visual Microphone algorithm that researchers found, which recreates sound by looking at micro-vibrations of objects (ex. potato chip bags and house plants).
I saw a talk on this recently by Prof. Bill Freeman, a co-author of the above work. The visual mic idea is based on a general technique for amplifying small motions; the motions here are the tiny movements of the bag.
I'm curious if anybody has ever had any real success with this concept as a personal project. (record audio with light)
My results were lackluster to say the least.
FFS, another Wired "if you take this interesting-but-very-primitive research result and ignore the orders of magnitude in sampling rate improvement needed, OMG SPYING" article.
Slightly more feasible than the last one which focused on detecting sound via image differences in high-speed (thousands of fps) camera footage, but still...
I suppose it would depend on the exact gyroscope; apparently some are more sensitive to audio frequency noise than others; some details in this document:
Its placement within the device will also affect the sensitivity to audio, so it will vary between device models - the article doesn't mention if 65% is worst-case, best-case, or an average.
Maybe not at this point, but if they spent some time writing better filtering and speech recognition algorithms it might be able to achieve a much higher accuracy.
Since it's currently so easy to get sensor data on android phones there's a fairly strong incentive for people interested in eavesdropping to do so.
It shows. Sampling at 200Hz means your masimum detectable frequency is 100Hz, per the Nyquist theorem - that'll capture ~40% of the typical male frequency range (fundamental only - not enough for harmonics or formants) and little or nothing of the typical female frequency range. I question the claimed 65% success rate, and would like to know a lot more about the experimental conditions before I'd be inclined to accept it. I do enough synthesis to know what that sort of sample rate sounds like without having to test, and the short answer is 'awful'. I can see possibly getting numbers out of it when the phone is held up to one's head but only in perfectly controlled environments. For contrast POTS bandwidth is 300 to 3400 Hz.
Or if an app really needed to access the gyroscope at high frequencies, it could be forced to ask permission. “There’s no reason a video game needs to access it 200 times a second,” says Boneh.
I think it's quite plausible that people might be able to detect a lag greater than 5ms in the right game. That's around the envelope for involuntary variation by professional drummers.