> On Thu, Sep 11, 2008 at 4:58 AM, Kevin Neff wrote:
> > Hi,
> >
> > Some secure protocols like SSH send encrypted keystrokes
> > as they're typed. By doing timing analysis you can figure
> > out which keys the user probably typed (keys that are
> > physically close together on a keyboard can be typed
> > faster). A careful analysis can reveal the length of
> > passwords and probably some of password itself.
> >
> > The paper:
> >
> >
http://portal.acm.org/citation.cfm?
> > id=1267612.1267637&coll=Portal&dl=GUIDE&CFID=1943417&C
> > FTOKEN=28290455
>
> The paper itself is not accessible. Prima facie, this looked like a
> technology-in-search-of-a-problem kinda thing to me. For now, it
> sounds like bull.
> However, there are atleast 10 references to keystoke
> timing/characteristics. That this 'weakness' holds water is a
> judgement call. Of course, one can make any kind of conclusion only
> after studying the paper/references.
>
> Hari
