Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does SSH send 100 packets per keystroke?

eieio.games

Post reply on HN
Print view View original

141–150 of 375 posts

Re: Why does SSH send 100 packets per keystroke?

#141

Post by AceJohnny2 »

layer8 wrote: post #86
idontwantthis wrote: post #46

If security doesn’t matter then why not use telnet or something else besides ssh instead of forking a security library?

Telnet nowadays typically isn’t available by default for security reasons, and OP wants people to be able to play the game just by typing “ssh thegamehost”.

> Telnet nowadays typically isn’t available by default for security reasons

And with good reason. This CVE is from yesterday:

https://nvd.nist.gov/vuln/detail/CVE-2026-24061

> telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Re: Why does SSH send 100 packets per keystroke?

#142

Post by layer8 »

AceJohnny2 wrote: post #141
layer8 wrote: post #86

Earlier quoted context omitted.

Telnet nowadays typically isn’t available by default for security reasons, and OP wants people to be able to play the game just by typing “ssh thegamehost”.

> Telnet nowadays typically isn’t available by default for security reasons And with good reason. This CVE is from yesterday : https://nvd.nist.gov/vuln/detail/CVE-2026-24061 > telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Telnetd is the server though, and OP wouldn’t be using that.

Re: Why does SSH send 100 packets per keystroke?

#143

Post by Mystery-Machine »

advisedwang wrote: post #40
dathinab wrote: post #10

> Keystroke obfuscation can be disabled client-side. please never do that (in production) if anyone half way serious tries they _will_ be able to break you encryption end find what you typed this isn't a hypothetical niche case obfuscation mechanism, it's a people broke SSH then a fix was found case. I don't even know why you can disable it tbh.

That doesn't sound right to me. This obfuscation isn't about a side-channel on a crypto implementation, this is about literally when your keystrokes happen. In the right circumstances, keystroke timing can reduce the search space for bruteforcing a password [1] but it's overstating to describe that as broken encryption. [1] https://people.eecs.berkeley.edu/~daw/papers/ssh-use01.pdf

THANK YOU!

I'm baffled about this "security feature". Besides from this only being relevant to timing keystrokes during the SSH session, not while typing the SSH password, I really don't understand how can someone eavesdrop on this? They'd have to have access to the client or server shell (root?) in order to be able to get the keystrokes typing speed. I've also never heard of keystroke typing speed hacking/guessing keystrokes. The odds are very low IMO to get that right.

I'd be much more scared of someone literally watching me type on my computer, where you can see/record the keys being pressed.

Re: Why does SSH send 100 packets per keystroke?

#144

Post by Mystery-Machine »

OneDeuxTriSeiGo wrote: post #56
eikenberry wrote: post #45

Earlier quoted context omitted.

It is to prevent timing attacks but there are many ssh use cases where it is 100% computer to computer communications where there is no key based timing attack possible.

There is an argument that if: - you are listening to an SSH session between devices - and you know what protocol is being talked over the connection (i.e. what they are talking about) - and the protocol is reasonably predictable then you gain enough information about the plaintext to start extracting information about the cipher and keys. It's a non-trivial attack by all means but it's totally feasible. Especially if…

I'd love to hear more about this kind of attack being exploited in the wild. I understand it's theoretically possible, but...good luck! :)

You're guessing a cipher key by guessing typed characters with the only information being number of packets sent and the time they were sent at. Good luck. :)

Re: Why does SSH send 100 packets per keystroke?

#148

Post by IshKebab »

H8crilA wrote: post #139
flumpcakes wrote: post #114

I don't see how Claude helped the debugging at all. It seemed like the author knew what to do and it was more telling Claude to think about that. I've used Claude a bit and it never speaks to me like that either, "Holy Cow!" etc. It sounds more annoying than interacting with real people. Perhaps AIs are good at sensing personalities from input text and doesn't act this way with my terse prompts..

AIs are exceptional at sensing personalities from text. Claude nailed it here, the author felt so good about the "holy cow" comments that he even included them in the blog post. I'm not just poking this, but saying that the bots are fantastic sycophants.

No they aren't. Current LLMs always have that annoying over-eager tone.

The comment about Claude being pumped was a joke.

Re: Why does SSH send 100 packets per keystroke?

#149

Post by JTbane »

mystraline wrote: post #109
BoppreH wrote: post #77

Earlier quoted context omitted.

Yes, but I wouldn't be surprised if the change is rejected. The crypto library is very opinionated, you're also not allowed to configure the order of TLS cipher suites, for example.

[flagged]

Personally I like that it's secure by default.

Re: Why does SSH send 100 packets per keystroke?

#150

Post by whatevaa »

JohnLeitch wrote: post #133
MrDarcy wrote: post #98

Earlier quoted context omitted.

How much are you staking on that bet?

Well, I spent a good part of my career reverse engineering network protocols for the purpose of developing exploits against closed source software, so I'm pretty sure I could do this quickly. Not that it matters unless you're going to pay me.

So you are basically overqualified to tell other people how to do it, especially with the payment part.
Post reply on HN