| |||||||||||||
not reallynot reallyPosted Sep 18, 2008 18:18 UTC (Thu) by djm (subscriber, #11651)In reply to: not really by epa Parent article: OpenSSH and keystroke timings
Actually OpenSSH already defends against this case: we detect when echo is turned off and send fake echo (SSH2_MSG_IGNORE) packets back in responses to keystrokes. This makes it more difficult for an attacker to tell when the user is actually typing in a password.
(Log in to post comments)
|
|||||||||||||