Hacker News Reader

I believe that passwords are not transmitted like this in SSHv2 because of that very attack (not to say there are not overwhelmingly good reasons to use public key authentication anyway).

View on HN

They can still get you if you invoke SSH on the remote, as the password is sent to the remote machine one character at a time, then forwarded on to your ultimate destination all at once.

Good point, though I imagine that this issue could be fixed in SSH as long as the password is not being echoed (which it should not be).

Ironically, I think it's actually slightly easier for an eavesdropper to detect that your keystrokes are part of a password if the password is not being echoed.

They could potentially use this information to know the length of a password, which would make brute-forcing easier. A very hypothetical attack, but fun to think about! Less effective than a $5 wrench, no doubt.

That is what public key/agent forwarding is for.

This will explain it better than I ever could: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html

Reply on news.ycombinator.com