Practical Keystroke Timing Attacks in Sandboxed JavaScript
interrupt.js exploits the interrupt-timing side channel in JavaScript. Using this implementation, it is possible to detect hardware interrupts, such as key presses or touchscreen interactions on mobile devices.
Try the live demo at https://iaik.github.io/interruptjs/
A trace might look something like this:
Xiaomi Redmi Note 3 | Google Nexus 5 |
---|---|
![]() |
![]() |
Touch 2x, Swipe, Touch 3x | Touch 2x, Swipe, Touch 3x |
We tested the code in Chrome and Firefox on both Android and Ubuntu. The code should work on every modern browser and any operating system using interrupts for I/O (that is virtually every operating system).