not really

Posted Sep 18, 2008 18:18 UTC (Thu) by djm (subscriber, #11651)
In reply to: not really by epa
Parent article: OpenSSH and keystroke timings

Actually OpenSSH already defends against this case: we detect when echo is turned off and send fake echo (SSH2_MSG_IGNORE) packets back in responses to keystrokes. This makes it more difficult for an attacker to tell when the user is actually typing in a password.