On Thu, Sep 11, 2008 at 4:58 AM, Kevin Neff  wrote:

quoted text
> Hi,

>

> Some secure protocols like SSH send encrypted keystrokes

> as they're typed.  By doing timing analysis you can figure

> out which keys the user probably typed (keys that are

> physically close together on a keyboard can be typed

> faster).  A careful analysis can reveal the length of

> passwords and probably some of password itself.

>

> The paper:

>

>  http://portal.acm.org/citation.cfm?

>  id=1267612.1267637&coll=Portal&dl=GUIDE&CFID=1943417&C

>  FTOKEN=28290455

The paper itself is not accessible. Prima facie, this looked like a

technology-in-search-of-a-problem kinda thing to me. For now, it

sounds like bull.

However, there are atleast 10 references to keystoke

timing/characteristics. That this 'weakness' holds water is a

judgement call. Of course, one can make any kind of conclusion only

after studying the paper/references.
Hari