Is password entry being recorded on camera a realistic concern?

Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device.

Shoulder-surfing is one reason why applications do not display the password text on the screen, but show ****** instead.

And this is one reason why multi-factor authentication is so important; even if you know the password, you cannot use it without another factor.

I have even seen viable research into capturing the sound of the keyboard when a user types the password, even over the computer's microphone.

So, yes, you describe a viable risk that the industry has been addressing for a long time. The specifics of high-res cameras is just not a significant enough of a new factor to consider. Shoulder-surfing and keyloggers are a current risk.

The industry knows that it needs to develop something better than passwords, and there are many active attempts to do so, but nothing is mature or stable enough yet.


As another example, here are some images from KrebsOnSecurity on ATM Skimmers (devices used to steal ATM credentials)


Camera 1 Hidden camera behind ATM faceplate (source)

Camera 2 Hidden camera glued to corner of ATM (source)

Camera 3 Hidden camera on fake panel of ATM (source)


So yes, it is a very real-world concern.


Also, there have been cases reported where thermal imagers were used to extract a PIN or password from a keyboard just used to enter it - the hotter a key, if time of finger contact is about equal (heat soaks in...), the more recently it has been pressed. This might not present the password on a silver platter due to duplicate keys, different finger dwell times, but can extremely narrow the possible passwords.