{"action":"closed","issue":{"url":"https://api.github.com/repos/golang/go/issues/6757","labels_url":"https://api.github.com/repos/golang/go/issues/6757/labels{/name}","comments_url":"https://api.github.com/repos/golang/go/issues/6757/comments","events_url":"https://api.github.com/repos/golang/go/issues/6757/events","html_url":"https://github.com/golang/go/issues/6757","id":51285676,"number":6757,"title":"ssh/terminal: leaks password keystroke timing.","user":{"login":"hanwen","id":31547,"avatar_url":"https://avatars.githubusercontent.com/u/31547?v=3","gravatar_id":"","url":"https://api.github.com/users/hanwen","html_url":"https://github.com/hanwen","followers_url":"https://api.github.com/users/hanwen/followers","following_url":"https://api.github.com/users/hanwen/following{/other_user}","gists_url":"https://api.github.com/users/hanwen/gists{/gist_id}","starred_url":"https://api.github.com/users/hanwen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hanwen/subscriptions","organizations_url":"https://api.github.com/users/hanwen/orgs","repos_url":"https://api.github.com/users/hanwen/repos","events_url":"https://api.github.com/users/hanwen/events{/privacy}","received_events_url":"https://api.github.com/users/hanwen/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/golang/go/labels/priority-triage","name":"priority-triage","color":"ededed"},{"url":"https://api.github.com/repos/golang/go/labels/release-none","name":"release-none","color":"ededed"},{"url":"https://api.github.com/repos/golang/go/labels/repo-crypto","name":"repo-crypto","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2013-11-13T10:43:54Z","updated_at":"2015-02-03T15:43:17Z","closed_at":"2015-02-03T15:43:17Z","body":"<pre>if echo==false, the terminal package does not write anything back for received\nkeystrokes, in effect leaking keystroke timing for passwords.\n\nIn OpenSSH, this is remedied with:\n\n               if (compat20 &amp;&amp; c-&gt;isatty &amp;&amp; dlen &gt;= 1 &amp;&amp; buf[0] != '\\r') {\n                        if (tcgetattr(c-&gt;wfd, &amp;tio) == 0 &amp;&amp;\n                            !(tio.c_lflag &amp; ECHO) &amp;&amp; (tio.c_lflag &amp; ICANON)) {\n                                /*\n                                 * Simulate echo to reduce the impact of\n                                 * traffic analysis. We need to match the\n                                 * size of a SSH2_MSG_CHANNEL_DATA message\n                                 * (4 byte channel id + buf)\n                                 */\n                                packet_send_ignore(4 + len);\n                                packet_send();\n                        }\n                }</pre>"}}