<story><title>Keystroke timing obfuscation added to ssh(1)</title><url>https://undeadly.org/cgi?action=article;sid=20230829051257</url></story><parent_chain><item><author>colmmacc</author><text>Keystroke timing has been a concern for terminal I&amp;#x2F;O since the 1980s and folks were using primitive encryption with stelnet and kerberos.&lt;p&gt;Most terminal applications use buffered I&amp;#x2F;O for password entry, which is still an important security feature. In that mode, nothing is sent to the other end until the user presses return. A MiTM only &amp;quot;sees&amp;quot; one packet no matter what, and with padding they can&amp;#x27;t even infer the password length.&lt;p&gt;For a time, there was rich pickings in applications that accepted passwords in unbuffered mode. Many of them doing it so that they could echo &amp;quot;*&amp;quot; symbols, character by character, as the user typed. That simple feature looks cool, and does give the user feedback ... but would leak the keystroke rate, which is the last thing you want on password entry.&lt;p&gt;I hope we preserve buffered I&amp;#x2F;O for password entry, because it&amp;#x27;s still better than what ssh can do with some obfuscation. But it&amp;#x27;s great to see ssh add this, and will help protect content that can&amp;#x27;t be buffered, like shell and editor input.</text></item></parent_chain><comment><author>pbhjpbhj</author><text>Aside, I&amp;#x27;ve noticed that the current technique of rendering a fixed number of asterisks independent of the password length is quite confusing to users -- &amp;quot;that&amp;#x27;s wrong, it&amp;#x27;s the wrong length&amp;quot;, resulting in attempts to type in the &amp;quot;correct&amp;quot; password and this obviating the benefit of the stored password.&lt;p&gt;Not sure how to fix that. I recall a visible hash of some form being used in the past (eg take a 2-digit hash, pair of with a smiley; I must have entered it right, it&amp;#x27;s showing me ROFL smiley), but that would aid shoulder surfed password entries, at least.</text></comment>
<story><title>Keystroke timing obfuscation added to ssh(1)</title><url>https://undeadly.org/cgi?action=article;sid=20230829051257</url></story><parent_chain><item><author>colmmacc</author><text>Keystroke timing has been a concern for terminal I&amp;#x2F;O since the 1980s and folks were using primitive encryption with stelnet and kerberos.&lt;p&gt;Most terminal applications use buffered I&amp;#x2F;O for password entry, which is still an important security feature. In that mode, nothing is sent to the other end until the user presses return. A MiTM only &amp;quot;sees&amp;quot; one packet no matter what, and with padding they can&amp;#x27;t even infer the password length.&lt;p&gt;For a time, there was rich pickings in applications that accepted passwords in unbuffered mode. Many of them doing it so that they could echo &amp;quot;*&amp;quot; symbols, character by character, as the user typed. That simple feature looks cool, and does give the user feedback ... but would leak the keystroke rate, which is the last thing you want on password entry.&lt;p&gt;I hope we preserve buffered I&amp;#x2F;O for password entry, because it&amp;#x27;s still better than what ssh can do with some obfuscation. But it&amp;#x27;s great to see ssh add this, and will help protect content that can&amp;#x27;t be buffered, like shell and editor input.</text></item></parent_chain><comment><author>eklitzke</author><text>Password based ssh authentication should be used approximately never.</text></comment>