keystroke timing attack

[Richard E. Silverman]

A couple observations:

1) The original poster (Jason) referred to the O'Reilly article on the timing
   attack, but confused timing user session data with SSH password
   authentication.  Jason: the distinction is actually carefully made in the
   article; see the first section under "Common Misconceptions."

2) In this thread, it is proposed to send dummy packets at either
   pseudo-random or fixed intervals.  Both of these are of questionable value,
   as is pointed out both in the article and in the Song et al. paper, as well
   as in Solar's paper.  The fixed-gap packets will show up as a tall spike in
   a frequency domain analysis of the timing data, and are easily filtered
   out.  Similarly, pseudo-random noise can be filtered, since the user typing
   data is *not* random.  This is especially true if one can gather repeated
   examples to average out the noise -- and people often type their passwords
   quite a lot.

--
  Richard Silverman
  slade at shore.net
  [disclosure: I wrote the O'Reilly article]