News for hackers. Stuff that matters.

A comment on Keystroke timing obfuscation added to SSH(1). Parent comment

Re:Keystroke timing obfuscation added to SSH(1) by yjftsjthsd-h on Tuesday August 29, 2023 @01:24PM (#37311067)
No, it's assuming a device running a ssh daemon with something mounted rw or user-modifiable[0] that can hold an authorized_keys file. A NetBSD embedded board that configures sshd with `AuthorizedKeysFile /sdcard/config/authorized_keys` would be fine, for instance.

[0] For example, you could let the user write their key to an SD card and then mount it ro on the device.

[ Parent | on HN ]
Re:Keystroke timing obfuscation added to SSH(1) by fragmede on Tuesday August 29, 2023 @02:48PM (#37312143)
So what do you do when the device has no long-term storage like an SD card?
[ Parent | on HN ]
Re:Keystroke timing obfuscation added to SSH(1) by samus on Tuesday August 29, 2023 @05:15PM (#37314229)
Such a device is then simply not suitable for situations where the issues with SSH password authentication become relevant.
[ Parent | on HN ]
Re:Keystroke timing obfuscation added to SSH(1) by yjftsjthsd-h on Wednesday August 30, 2023 @05:46PM (#37329587)
What kind of device runs sshd but has no persistent storage?
[ Parent | on HN ]