News for hackers. Stuff that matters.

A comment on Keystroke timing obfuscation added to SSH(1). Parent comment

Re:Keystroke timing obfuscation added to SSH(1) by dmazzoni on Tuesday August 29, 2023 @11:51AM (#37309726)
Years ago when I saw a paper on that topic, I tried recording my own keyboard and trained a ML model to classify keystrokes. I used a SVM, to give you an idea of how long ago this was.

I got to 90% accuracy extremely quickly. The "guessed" keystrokes had errors but they were close enough to tell exactly what I was typing.

If I could do that as an amateur in a few hours of coding with no advanced signal processing and with the first SVM architecture I tried, it must be relatively easy to learn / classify.

[ Parent | on HN ]
Re:Keystroke timing obfuscation added to SSH(1) by remus on Tuesday August 29, 2023 @02:36PM (#37311983)
Also, if the goal was to guess a password you wouldn't necessarily need it to be really accurate. Just narrowing the search space could get you close enough that a brute force attack could do the rest.
[ Parent | on HN ]