Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does SSH send 100 packets per keystroke?

eieio.games

Post reply on HN
Print view View original

101–110 of 375 posts

Re: Why does SSH send 100 packets per keystroke?

#101

Post by pbar »

JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Unfortunately with SSH specifically, the dissectors aren't very mature - you only get valid parsing up to the KeX completion messages (NEWKEYS), and after that, even if the encryption is set to `none` via custom patches, the rest of the message flow is not parsed.

Seems because dumping the session keys is not at all a common thing. It's just a matter of effort though - if someone put in the time to improve the SSH story for dissectors, most of the groundwork is there.

Re: Why does SSH send 100 packets per keystroke?

#102

Post by WesolyKubeczek »

observationist wrote: post #64
snowmobile wrote: post #2

> That 20ms is a smoking gun - it lines up perfectly with the mysterious pattern we saw earlier! Speaking of smoking guns, anybody else reckon Claude overuses that term a lot? Seems anytime I give it some debugging question, it'll claim some random thing like a version number or whatever, is a "smoking gun"

Or the "Eureka! That's not just a smoking gun, it's a classic case of LLMspeak." Grok, ChatGPT, and Claude all have these tics, and even the pro versions will use their signature phrases multiple times in an answer. I have to wonder if it's deliberate, to make detecting AI easier?

A computational necromancer has likely figured out a way to power a data center by making Archimedes spin in his grave very fast.

Re: Why does SSH send 100 packets per keystroke?

#103

Post by Calvin02 »

swiftcoder wrote: post #11

> Obviously forking go’s crypto library is a little scary, and I’m gonna have to do some thinking about how to maintain my little patch in a safe way This should really be upstreamed as an option on the ssh library. Its good to default to sending chaff in untrusted environments, but there are plenty of places where we might as well save the bandwidth

Threats exist in both trusted and untrusted environments though.

This feels like a really niche use case for SSH. Exposing this more broadly could lead to set-it-and-forget-it scenarios and ultimately make someone less secure.

Re: Why does SSH send 100 packets per keystroke?

#104

Post by charcircuit »

zamadatix wrote: post #15

Very interesting, I hadn't heard of this obfuscation before so it was well worth clicking. Another good trick for debugging ssh's exact behavior is patching in "None" cipher support for your test environment. It's about the same work as trying to set up a proxy but lets you see the raw content of the packets like it was telnet. For terminal games where security does not matter but performance and scale does, just off…

It made the front page when it was added.

https://news.ycombinator.com/item?id=37307708

Re: Why does SSH send 100 packets per keystroke?

#105

Post by turtlebits »

JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Way to gatekeep. God forbid people use tools to help them investigate instead of knowing the exact approach to take.

Re: Why does SSH send 100 packets per keystroke?

#106

Post by Animats »

adgjlsfhk1 wrote: post #94
Animats wrote: post #84

In 2023, ssh added keystroke timing obfuscation. The idea is that the speed at which you type different letters betrays some information about which letters you’re typing. So ssh sends lots of “chaff” packets along with your keystrokes to make it hard for an attacker to determine when you’re actually entering keys. Now that's solving the problem the wrong way. If you really want that, send all typed characters at 50m…

Typing with an extra 50ms latency will be fairly unpleasant.

Average is 25ms. Just put sending on a clock.

Re: Why does SSH send 100 packets per keystroke?

#107

Post by omoikane »

Animats wrote: post #84

In 2023, ssh added keystroke timing obfuscation. The idea is that the speed at which you type different letters betrays some information about which letters you’re typing. So ssh sends lots of “chaff” packets along with your keystrokes to make it hard for an attacker to determine when you’re actually entering keys. Now that's solving the problem the wrong way. If you really want that, send all typed characters at 50m…

> send all typed characters at 50ms intervals

Wouldn't this just change the packet interval from 20ms to 50ms? Or did you mean a constant stream of packets at 50ms intervals, nonstop?

I think the idea behind the current implementation is that the keystrokes are batched in 20ms intervals, with the optimization that a sufficiently long silence stops the chaff stream, so the keystroke timing is obfucated with an increased error bar of 20ms multiplied by number of chaff packets.

Re: Why does SSH send 100 packets per keystroke?

#108

Post by mystraline »

MrDarcy wrote: post #98
JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

How much are you staking on that bet?

Sigh.

I'm still waiting for a systems engineering tool that can log every layer, and handle SSL the whole pipe wide.

Im covering everything from strafe and ltrace on the machine, file reads, IO profiling, bandwidth profiling. Like, the whole thing, from beginning to end.

Theres no tool that does that.

Hell, I can't even see good network traces within a single Linux app. The closest you'll find is https://github.com/mozillazg/ptcpdump

But especially with Firefox, good luck.

Re: Why does SSH send 100 packets per keystroke?

#109

Post by mystraline »

BoppreH wrote: post #77
swiftcoder wrote: post #11

> Obviously forking go’s crypto library is a little scary, and I’m gonna have to do some thinking about how to maintain my little patch in a safe way This should really be upstreamed as an option on the ssh library. Its good to default to sending chaff in untrusted environments, but there are plenty of places where we might as well save the bandwidth

Yes, but I wouldn't be surprised if the change is rejected. The crypto library is very opinionated, you're also not allowed to configure the order of TLS cipher suites, for example.

[flagged]

Re: Why does SSH send 100 packets per keystroke?

#110

Post by kkkqkqkqkqlqlql »

turtlebits wrote: post #105
JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Way to gatekeep. God forbid people use tools to help them investigate instead of knowing the exact approach to take.

My thoughts exactly. The OP used AI to get a starting point to their investigation, then used their skills to improve their game, with actual (I guess according to the article itself) proof of that, as opposed to just approving changes from the LLM.

This looks like an actual productivity boost with AI.

Post reply on HN