Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does SSH send 100 packets per keystroke?

eieio.games

Post reply on HN
Print view View original

361–370 of 375 posts

Re: Why does SSH send 100 packets per keystroke?

#361

Post by pseudohadamard »

tracker1 wrote: post #328
pseudohadamard wrote: post #267

Earlier quoted context omitted.

It's not just the pointless chaff, the SSH protocol is inherently very chatty, and SFTP even more so. The solution, for a high-performance game, is don't use SSH . Either run it over Wireguard or grab some standard crypto library and encrypt the packets yourself. You'll probably make a few minor mistakes but unless the other player is the NSA it'll be good enough. For that matter, why does it need to be encrypted at…

Serious question, why not just use websockets? AFAIK, it's effectively a TLS socket with a little bit of handshake overhead when starting. I'm literally working on a web interface I want to use for classic BBS door play... currently working on a DOS era EGA interface, and intend to do similar for PETSCII/Comodore64/128 play as well. I've got a couple rendering bugs to explore for ansis submitted that messed up in the…

Websockets is just another layer on top of TLS, so you've got the size explosion and complexity/latency of TLS and then another layer on top of that. The OP hasn't provided additional info on what the requirements are but if it's a realtime game then they'll probably be "as close to zero latency and size increase as possible (compared to unencrypted messaging)", which websockets over TLS isn't.

Re: Why does SSH send 100 packets per keystroke?

#362

Post by moffkalast »

sam_lowry_ wrote: post #308
zamadatix wrote: post #15

Very interesting, I hadn't heard of this obfuscation before so it was well worth clicking. Another good trick for debugging ssh's exact behavior is patching in "None" cipher support for your test environment. It's about the same work as trying to set up a proxy but lets you see the raw content of the packets like it was telnet. For terminal games where security does not matter but performance and scale does, just off…

Sadly, much fewer computer systems have telnet nowadays. Also, port 21 is often blocked.

Telnet, I want her to know it was me.

Re: Why does SSH send 100 packets per keystroke?

#363

Post by drzaiusx11 »

da_chicken wrote: post #356
drzaiusx11 wrote: post #353

Earlier quoted context omitted.

I think it was a joke implying you'd be old enough to forget because of age, which in my case is definitely true...

No, just that confusing the two was ubiquitous at the time 14.4k, 28k, and 56k modems were the standard. Like it was more common than confusing Kbps and KBps. I mean, the 3.5" floppy disk could store 1.44 MB... and by that people meant the capacity was 1,474,560 bytes = 1.44 * 1024 * 1000. Accuracy and consistency in terminology has never been particularly important to marketing and advertising, except marketing and…

I started out with a 2400 baud US Robotics modem with my "ISP" being my local university to surf gopher and BBS. When both baud rates and bits per second were being marketed side by side I kinda lost the thread tbh. Using different bases for storage vs transmission rates didn't help.

Re: Why does SSH send 100 packets per keystroke?

#364

Post by svnt »

eieio wrote: post #34
svnt wrote: post #25

> I am working on a high-performance game that runs over ssh. Found your problem. But it is an interesting world where you can casually burrow into a crypto library and disable important security features more easily than selecting the right network layer solution.

the obtuseness is the point! This is true of a lot of my work[1][2][3]. The problems you run into when doing things you shouldn't do are often really fun. [1] https://news.ycombinator.com/item?id=42342382 [2] https://news.ycombinator.com/item?id=37810144 [3] https://news.ycombinator.com/item?id=42674116

Ah I see now. The characteristic irony I associate with Brooklyn making its way online. Well done.

Re: Why does SSH send 100 packets per keystroke?

#365

Post by TruePath »

CaptainNegative wrote: post #186
reincarnate0x14 wrote: post #157

Earlier quoted context omitted.

It sort of already is. This behavior is only applied to sessions with a TTY and then the client can disable it, which is a sensible default. This specific use case is tripping it up obviously since the server knows ahead of time that the connection is not important enough to obfuscate and this isn't a typical terminal session, but in almost any other scenario there is no way to make that determination and the client…

What's a concrete threat model here? If you're sending data to an ssh server, you already need to trust that it's handling your input responsibly. What's the scenario where it's fine that the client doesn't know if the server is using pastebin for backing up session dumps, but it's problematic that the server tells the client that it's not accepting a certain timing obfuscation technique?

To clarify the point in the other reply -- imagine it sent one packet per keystroke. Now anyone sitting on the network gets a rough measurement of the delay between your keystrokes. If you are entering a password for something (perhaps not the initial auth) it can guess how many characters it is and turns out there are some systemic patterns in how that relates to the keys pressed -- eg letters typed with the same finger have longer delays between them. Given the redundancy in most text and especially structured input that's a serious security threat.

Re: Why does SSH send 100 packets per keystroke?

#366

Post by TruePath »

KennyBlanken wrote: post #336
swiftcoder wrote: post #11

> Obviously forking go’s crypto library is a little scary, and I’m gonna have to do some thinking about how to maintain my little patch in a safe way This should really be upstreamed as an option on the ssh library. Its good to default to sending chaff in untrusted environments, but there are plenty of places where we might as well save the bandwidth

The guy in charge of Go's security decreed that SSL 1.3 (which he was a contributor to) was so secure that silly programmers should not be able to override what algorithms are allowed or not allowed, because why would they possibly need to do that, because he's such a genius, and even if someone DID find a security vulnerability, well....they can just wait for Google to publicly disclose it and release a patch, compi…

Lots of the real world vulnerabilities out there exist exactly because of people choosing to support a range of crypto algorithms.

Sure, if it's an internal tool you can recompile both ends and force a universal update. But anything else and you need to stay compatible with clients and anytime you allow negotiation of the cryptosuit you open yourself up to quite a few subtle attacks. Not saying that choice about go is clearly a good one but i don't think it's obviously wrong.

Re: Why does SSH send 100 packets per keystroke?

#367

Post by TruePath »

What is the usecase for using ssh at all where you don't need to be resistant against timing analysis? Either it's not sensitive and you can use telnet (if necessary after using ssh to authenticate) or the game (or other stuff on the connection) might be sensitive and you need traffic analysis resistance.

If you get clever and write a client to ensure sensitive data like passwords or email are sent in a burst you could just use an encryption library just for that data instead.

Re: Why does SSH send 100 packets per keystroke?

#368

Post by halJordan »

TruePath wrote: post #367

What is the usecase for using ssh at all where you don't need to be resistant against timing analysis? Either it's not sensitive and you can use telnet (if necessary after using ssh to authenticate) or the game (or other stuff on the connection) might be sensitive and you need traffic analysis resistance. If you get clever and write a client to ensure sensitive data like passwords or email are sent in a burst you cou…

Dont let this article be blinders to you. Ssh does much more than obfuscate keypress timings. Not needing the chaff means turn it off and keep all the other benefits. It doesn't mean "revert to telnet"

Re: Why does SSH send 100 packets per keystroke?

#369

Post by dent9 »

> When you say “LLMs did not fully solve this problem” some people tend to respond with “you’re holding it wrong!” > > I think they’re sometimes right! Interacting with LLMs is a new skill, and it feels pretty weird if you’re used to writing software like it’s 2020. A more talented user of LLMs may have trivially solved this problem.

So one thing I only recently figured out is that using ChatGPT via the web browser chat is massively different from using OpenAI's code-focused Codex model / interface. Once I switched to using Codex (via the VS Code extension + my own ChatGPT subscription) the quality of answers I got improved massively.

So if you're trying to use LLM to help with debug, make sure you're using the right model!! There are apparently massive differences between models of the same generation from the same company

Re: Why does SSH send 100 packets per keystroke?

#370

Post by costco »

ruszki wrote: post #360
fsniper wrote: post #343

Earlier quoted context omitted.

Unfortunate result of the security theater.. "Someone who has access to run privileged application can run side channel attacks! Let's drop cpu performance 20 percent over the world"

As I understood it’s enough to have “access to run privileged application” anywhere where the packet goes through. So, not necessarily at client or server sides. Or did I misunderstand?

I think he's referring to CPU mitigations: https://en.wikipedia.org/wiki/Transient_execution_CPU_vulner...
Post reply on HN