The short version
Your webcam doesn’t need to see your keyboard to leak what you’re typing. Recent security research shows that during video calls, an attacker can track the motion of your fingers, hands, and even shoulders to infer keystrokes and recover words—sometimes a lot of them. The good news: a few camera and ergonomics tweaks can dramatically reduce what leaks. (ndss-symposium.org)
How the attacks actually work (no scare‑mongering)
- Video keystroke inference: In a landmark study, researchers modeled typing‑related body motion in video calls (arms/shoulders/fingers), detected the moments you press keys, then used language models to guess likely words. In controlled tests they recovered up to 75% of typed words; even in realistic, at‑home setups, they could reliably spot when usernames or emails were entered (around 91–96%). Crucially, they found that lowering video quality, causing blur/pixelation, or dropping frames hurts attacker accuracy. (ndss-symposium.org)
- Beyond webcams-in-calls: A 2023 USENIX Security paper showed a commodity smartphone camera (0.8–3 m away) can reconstruct typed content from hand motion with low word error rates; even a 12 m “through‑glass” shot preserved a high fraction of meaning, though with more errors. The technique uses fingertip tracking plus language models—no special keyboard knowledge or pretraining on the victim. (usenix.org)
- Audio is a separate (and real) risk: Other teams hit ~93% character accuracy for keystrokes over Zoom audio alone, but this post focuses on the video side channel. (arxiv.org)
Try it right now: a tiny in‑browser motion demo
The snippet below (for your site’s devs) draws fingertip traces in your browser using MediaPipe Hands. It’s not an attack—just a feel‑for‑the‑signal demo that shows how visible and regular your typing movements are when your hands are in frame.
```html
```
MediaPipe Hands is a standard JS hand‑tracking library; use it on‑device only for user privacy. (github.com)
What really makes you leak—and how to fix it fast
Here are practical, low‑friction mitigations that target what the research says attackers need.
1) Keep hands and shoulders out of frame
- Why: The call‑attack models rely on seeing shoulder/upper‑arm motion and fingertip trajectories. When those are occluded or cropped out, inference quality drops or fails. In one at‑home session, simply having hair covering the shoulder area made the video unusable for the attack. Raise the camera to a true head‑and‑shoulders crop or angle it so forearms and keyboard area aren’t visible. (ndss-symposium.org)
2) Automatic blur/pixelate while you type
- Why: Researchers tested per‑keystroke video edits and saw large drops in word recovery. Blurring about 200 ms of frames around each keypress reduced average top‑50 word recovery from ~65% to ~13%; pixelation cut it to ~4.3%. The most potent option was “frame skipping” during keystrokes, leaving only ~3% of words recoverable (but it can look like a brief freeze). (ndss-symposium.org)
- How: If you use a virtual camera (e.g., OBS, ManyCam), a small plugin can listen for local keypress events and blur/pixelate the hand region or temporarily drop frames. Apply the effect only around typing bursts to minimize visual impact. (ndss-symposium.org)
3) Nudge your video pipeline to be “harder to read”
- Why: The attack pipelines are very sensitive to video quality and temporal consistency; frame drops, motion blur, or reduced detail hurt accuracy. (ndss-symposium.org)
- Do this on Zoom/Meet/Teams:
- Disable HD/1080p unless you truly need it; favor 360p–720p. Meet and Teams dynamically adjust quality, and Teams exposes “sent frame rate” that can vary from ~1–30 fps. Lower resolution and variable frame rate mean less precise motion cues. (workspaceupdates.googleblog.com)
- In Zoom, skip enabling HD and consider “Adjust for low light,” which adds smoothing and can introduce subtle blur; Zoom’s SDK notes it preserves frame rate and trades resolution under bandwidth pressure—good for privacy. (support.zoom.com)
- If your platform has a “low bandwidth” or “data saver” mode, use it; that typically reduces detail and/or consistency, both of which attackers want. (learn.microsoft.com)
4) Clothing and surfaces that dampen signals
- Long or short sleeves slightly reduced word recovery versus sleeveless in lab tests (likely because cloth masks arm displacement). If you type a lot on calls, prefer sleeves. (ndss-symposium.org)
- Early 2026 work explores optical‑vibration side channels (capturing tiny desk vibrations via video). A soft desk‑mat can physically damp vibrations; while this defense is still “experimental,” it’s a cheap precaution. (minglics.github.io)
5) Ergonomics and layout choices
- Touch‑typing with steady wrists leaks less than hunt‑and‑peck, which produced higher recovery rates in tests. Layouts and positions that minimize big arm/shoulder swings (e.g., a compact keyboard kept low and out of frame) reduce the visible motion attackers exploit. Don’t rely on exotic key layouts alone—some attacks explicitly avoid needing layout knowledge. (ndss-symposium.org)
6) Workflow tweaks
- For secrets (passwords, 2FA codes, API keys): briefly mute your video or slide hands out of frame; paste from a password manager instead of typing; or use a separate device that isn’t on camera. These are low‑tech but highly effective against vision‑based inference.
A pre‑test “Camera Safety Check” your typing site can ship
Before launching a timed test, show users a 10‑second privacy check:
- Step 1: Preview + landmarks. Run a local hand‑landmarker and warn if hands/forearms are detected in frame below chest level.
- Step 2: Micro‑typing probe (optional). Ask the user to type “privacytest” for 3 seconds; show a simple motion graph. If strong periodic bursts appear, suggest moving hands out of frame or enabling blur‑on‑type.
- Step 3: One‑click mitigations. Offer toggles to crop to head‑and‑shoulders, enable a light blur/pixelate‑on‑type filter, and reduce output resolution for the virtual camera.
- Step 4: Explain clearly that this protects typing privacy—not just for your test, but for all calls.
For security teams and power users
- Virtual camera pipeline (OBS/ManyCam) lets you implement blur/pixelate/frame‑skip on keystroke without touching Zoom/Meet/Teams clients. This approach matched the research mitigation model and is practical today. (ndss-symposium.org)
- If you must type secrets on camera, consider “freeze‑on‑type” for 150–250 ms; it’s visually noticeable but the most effective defense in testing. (ndss-symposium.org)
Bottom line
Video‑based keystroke inference is no longer hypothetical. But a few friendly defaults—keep hands out of frame, blur/pixelate during typing, and avoid pristine, high‑fps, high‑res feeds—go a long way toward protecting your typing privacy on Zoom/Meet/Teams. (ndss-symposium.org)
