Hacker News Reader

Comment by hu3 | Hacker News Reader

Keystrokes + IP = NSA knows exactly what I'm typing.

This "feature" should be off by default on any software that claims to be a privacy respecting alternative to Chrome.

It's been my impression that privacy from the NSA is, realistically, not something any commercially viable web company can offer you. An exception can probably be made for a site that operates outside of US influence serving customers outside US influence.

Uhh, most products can offer plenty enough defense against opportunistic blanket surveillance (but broadcasting your keystrokes is probably not going to help there). Protection against targeted attacks is a whole different story.

If you are ok with some extra latency you can enable our “search via proxy” feature which proxies all queries and hide your IP. Maybe that is what you are looking for?

Can you ID someone positively by their typing patterns and an IP?

Yes. Also search WW2 war stories about radio operators, this technique dates back since then. US Pacific operators always knew which Japanese radio operator was transmitting Morse codes by listening to their typing patterns. And if a human was able to do it, imagine the accuracy of computers in this regard.

I was a ham radio operator for several years. It was easy to ID my frequent contacts by their morse code transmission patterns, and they me. An operator's pattern was called their "fist".

You most likely can. Just listening to people type on a keyboard gives a very unique feel with each person. Try it sometime, listen to family members and colleagues type or find some youtube video. I can ID all my family members and some coworkers by the sound of their typing.

Obviously, if you can get the content of what they're typing, it gets much easier still. I think I've seen papers where they ID programmers based on the code they've produced. This applies to other types of writing too.

You can build a model from keystroke timings and figure out people's SSH passwords too. https://www.usenix.org/legacy/events/sec01/full_papers/song/...

Now do it with random network jitter.

The main problem here is that even if you could do it, why would you? There are over 3.4 billion Internet users in the world. Given that people share IP addresses and even browsers, what's the actually gain identifying someone through typeahead search keystroke jitter? This would spend a lot of effort, and and then tell you what that a cookie doesn't?

I can't imagine that it's actually worth the effort.

Yes, just like you can recognize someone by their footsteps. Most likely you don't even need the IP.

Reply on news.ycombinator.com