Apple Vision Pro’s Eye Tracking Exposed What People Type (www.wired.com)

submitted 9 months ago by BrikoX@lemmy.zip to c/cybersecurity@sh.itjust.works

11 comments fedilink hide all child comments

The Vision Pro uses 3D avatars on calls and for streaming. These researchers used eye tracking to work out the passwords and PINs people typed with their avatars.

Archived version: https://web.archive.org/web/20240912100207/https://www.wired.com/story/apple-vision-pro-persona-eye-tracking-spy-typing/

you are viewing a single comment's thread
view the rest of the comments

[-] narc0tic_bird@lemm.ee 22 points 9 months ago

That should be an easy fix in a future software update by simply not replicating eye movement as soon as the user is looking at the keyboard.

[-] Plopp@lemmy.world 25 points 9 months ago

The solution is constant googly eyes.

[-] Empricorn@feddit.nl 15 points 9 months ago

Let's be honest: the solution is always googly eyes.

[-] mxcory@lemmy.blahaj.zone 1 points 9 months ago

https://youtu.be/zc7qJE9Nzo8

[-] GamingChairModel@lemmy.world 6 points 9 months ago

Sounds like what they already did: as soon as the virtual keyboard pops up the eye movement isn't transmitted as part of the avatar.

[-] narc0tic_bird@lemm.ee 5 points 9 months ago

Oh I see. According to the article:

The GAZEpolit researchers reported their findings to Apple in April and subsequently sent the company their proof-of-concept code so the attack could be replicated. Apple fixed the flaw in a Vision Pro software update at the end of July, which stops the sharing of a Persona if someone is using the virtual keyboard.

An Apple spokesperson confirmed the company fixed the vulnerability, saying it was addressed in VisionOS 1.3.

this post was submitted on 12 Sep 2024

84 points (96.7% liked)

Cybersecurity

7688 readers

60 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social