| |||||||||||||
not reallynot reallyPosted Sep 18, 2008 8:53 UTC (Thu) by epa (subscriber, #39769)In reply to: not really by dlang Parent article: OpenSSH and keystroke timings
how would ssh know that you are sending a password?Password prompts already send special magic characters to the tty to turn off echoing. It would need only a small extension to su(1) or ssh(1) to make them echo a new sequence meaning 'I am reading a password now'. The remote ssh client would note this and batch up a whole line of input to send at once.
(Log in to post comments)
not really Posted Sep 18, 2008 18:18 UTC (Thu) by djm (subscriber, #11651) [Link]
Actually OpenSSH already defends against this case: we detect when echo is turned off and send fake echo (SSH2_MSG_IGNORE) packets back in responses to keystrokes. This makes it more difficult for an attacker to tell when the user is actually typing in a password.
|
|||||||||||||