Cute SSH Vulnerability

Here's another, somewhat fascinating reason to use your RSA keys with SSH: Berkeley researcher Dawn Xiaodong Song has figured out how to guess passwords typed into a shell over SSH by using statistical timing analysis. Here's an article about it. She's able to reduce brute force attacks on 7-8 character password by a factor of 50 with this approach. She points out some interesting tidbits about SSH that will help you out, but you'll have to read her paper to find them.