I even remember reading about how Clifford Stoll recognized the different attackers by "typing rhythm" in Cuckoo's Egg.
What about a virtual keyboard on the screen? What if we have our custom-built virtual keyboard with random arrangements of keys every time I want to type a Password?
2016 - "Don't Skype & Type! Acoustic Eavesdropping in Voice-Over-IP" - https://arxiv.org/abs/1609.09359
2020 - "Behavioral Acoustic Emanations: Attack and Verification of PIN Entry Using Keypress Sounds" - https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7309150/
Maybe they mean this one...
2023 - "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards" - https://arxiv.org/abs/2308.01074
Now, from memory I’m pretty sure there is a scene where the visually impaired / blind Hacker can work out the password by listening to the audio on the surveillance tape!
I’m probably mangling my memory of the scene, so please correct me! :-)
Job done.
Biometric to unlock phone, PIN to load 2FA auth app, and a password to actually login.
Actually, I am reminded of the 00s when companies used to have badges and badge readers you'd take home and plugin to your machine and you had to use those to authenticate connections.
Password + physical token. It was secure, but not convenient if you left your badge behind somewhere.
It wasn't wireless, no worries about snooping.
When it did work, it was magic. My Active Directory credentials automatically carried over between machines, across networks, for debugging purposes to dev boxes, and I was even able to step from C# code running locally into a stored procedures on a remove SQL server all from within (the OG) Visual Studio.
Nothing works anything near that well anymore. :(
(Show of hands, who here reading this can start debugging their staging environment databases from within their IDE, with a single button press?)
Are you thinking of password manager? Most password managers involve entering the master password. Some can open with fingerprint but need to use the password occasionally.
Are you thinking about passkeys? Those aren’t 2FA.
EDIT: I guess you're right in that the parent was suggesting NOT typing passwords and sort of equating that to 2FA. so yeah, I like to keep one password in my head only (for sensitive stuff) and use a second factor if possible
(which to my knowledge only happened once when I set the root password on my VPS to 'toor' before i knew about internet background hacking radiation, and sure maybe i'm compromised right now, but it's absolutely not affecting my day to day life so i'm not gonna worry about it)
Of course it does also have downsides. I don’t store all my passwords there.
In any case, I'm far far more worried about not being able to log into something because there's too much security than I am worried about someone accessing my things when they shouldn't. The former has cost me many more productive minutes than the latter.