Re:Keystroke timing obfuscation added to SSH(1)
by maccard on Tuesday August 29, 2023 @04:30PM
(#37313552)
I don't type passwords. My password manager fills them for me, or I paste them.
[ Parent
| on HN ]
Re:Keystroke timing obfuscation added to SSH(1)
by jamedjo on Tuesday August 29, 2023 @05:56PM
(#37314678)
Unlocking the password manager means I need to type a master password in while in a public place. Feels higher risk when it is an unimportant website but potentially gives access to all websites. Still better than the passwords being accessible on disk but having individual passwords would reduce the impact of any password leak.
Re:Keystroke timing obfuscation added to SSH(1)
by maccard on Tuesday August 29, 2023 @06:01PM
(#37314719)
1password uses biometrics on my 7 year old MacBook Pro, so even if I'm out and about I still don't need to type it.
Re:Keystroke timing obfuscation added to SSH(1)
by riffraff on Wednesday August 30, 2023 @02:21AM
(#37318359)
1p works great on my mac but still asks for a password from time to time, I'm not sure of the exact mechanic.
OTOH even Chrome's password manager now integrates with the Mac fingerprint auth.
Re:Keystroke timing obfuscation added to SSH(1)
by maccard on Wednesday August 30, 2023 @08:23AM
(#37320944)
It's every two weeks. If your threat model involves being spied on over the shoulder for your master password while in a cafe you "just" need to ensure you enter your password in a safe location every two weeks.
Re:Keystroke timing obfuscation added to SSH(1)
by fluidcruft on Tuesday August 29, 2023 @08:39PM
(#37316139)
I have this InputStick USB dohicky that shows up as a generic USB keyboard when plugged in but is also an encrypted Bluetooth dongle. There's a plugin to Keepass2Android that I use to type passwords from my phone. I use that to unlock my password manager (using a giant untypable passphrase).