Should I not use wireless keyboards and mice?

Anything wireless usually increases your attack surface beyond what physical controls are normally in place.(e.g. locked doors)

The question is if it is an acceptable risk.

Many keyboards do have encryption, Logitech for example use aes128. I don't know if the key exchange is secure though.

But with a Logitech keyboard you would still require physical proximity under 50-75 meters as the signal is terrible even with antennas.

Are you interesting enough to warrant someone go spend the money and time to physically stalk you and your keyboard?

If so, and if the risk is high, then maybe you should go back to using a wired keyboard.

There is always a risk, the question is about how much risk you can tolerate.

If you are worried about people stealing all your money from your bank account, don't store all your money in the same bank. Diversity your risk.

Sniffing keyboard signals would be one of the least efficient ways to capture credentials. Sniffing the mouse is about as useful as using a paperclip to rob a bank. Regardless of efficiency though, unless you're a VIP who's been targeted before you're not at risk.

If I was an attacker trying to capture creds or your keylogs, sniffing your wireless keyboard strokes would be utterly pointless. Why?

I'd have to first find out if you're even using a wireless device. Then find out which brand and specific model you're using. Then I need to go out and buy that device to test it myself given there's no public methods already released and that are proven to work reliable in the wild and not in some unrealistic test lab.

So I buy the device and hopefully discover that it's even possible to intercept and successfully interpret those wireless signals. Ok let's assume I have and it took me a month.

Now I need to create a program that will automatically do it for me and that will also reliably work in the wild. That could take anywhere from a weekend to a month or even a year, who knows. Let's assume it took me just a month and im ready to go and use it on you. Now where are you? I have to physically be within sniffing range of the device to capture anything. So I stalk you to work or your house? Ok but where's the keyboard? Maybe I can just sit outside and listen there? What if theres a fridge in between or a wall with some lead pipes in it? Even within 50 feet wireless signals can't penetrate everything...

But let's assume my tool worked, I got close enough, and at that moment you were logging into reddit and I saw those keystrokes meaning my tool successfully sniffed, decoded and interpreted your password.

Great, but now which creds do I want? Email maybe? Alright... so how many people keep their accounts logged in and dont retype their passwords every time? Lots. Or how many use password managers and form autofillers, like lastpass? Lots. What are the chances this is the case? High. What are the chances you actually type your password while im within range, still outside your location, even notice, leave and compromise that account? Very, very low.

I'm also going to take a shot in the dark and say those who are good about logging out also use 2factor auth for logging in to important accounts and don't reuse pws and keep them relatively uncrackable. So even if I somehow managed to grab your email creds as you typed them, unless I'm MITM'ing those signals, I cant reuse the 2factor code (even if I managed to get it quickly enough) after you already have, making the creds I just captured useless.

So I spent all that time and effort targeting you, finding which keyboard you use, buying it myself, finding a bug or implementing a method for keystroke interception and decryption, created an automated tool, proved it worked technically, risked going to jail by stalking you to your house/work and tresspassing to get within range of your keyboard and for what? Well I managed to get some creds but failed to actually use them because you had 2factor enabled.

All this for nothing, that's what. But it shows that if you're worried about credential theft or spying, a tin foil hat won't protect you or your keyboards, because, attackers take the easiest approach proven to already work, and wireless keyboard sniffing isn't one of them. Usually they'll send you a spearphishing email with a link that takes you to a phishing page and which supports 2factor too. Or malware/exploits, whichever.

You may notice these spearphish attacks once or twice initially and laugh at their attempts. But can you keep that up for the rest of your life? You're human and that means you're not perfect and indeed make mistakes. One mistake is all they need and time is on THEIR side.

This is why unless you're being targeted or realisticly even worth being targeted, use all the wireless devices your heart desires but leave off the tin foil. Five eyes or anybody else capable of sophisticated attacks don't give a shit about you, or even me. And I mean that in the nicest way!

Feel free to remind yourself of this if you're losing sleep over it.

Yeah, I've never felt that I comfortably knew how the security worked (and there certainly are wireless keyboard and mice with awful security) so I just use wired devices on important computers. For the Mac Mini hooked up to the TV, meh.

I do wish I knew for even one device, here is how the encryption and key exchange works, it is in fact competently done.

https://www.youtube.com/watch?v=WqkmGG0biXc

Wireless key sweeper for Microsoft keyboards.

Have a look at this: http://www.remote-exploit.org/articles/keykeriki_v2_0__8211_2_4ghz/index.html

Keep in mind that BlueTooth uses 1mW, which typically translates to less than 30 feet. While there are attacks (see bluesniper), overall unless you see a surveillance van parked out front, or you are within a couple hundred feet of a college dorm, you are not at risk.