Reminds me very much of the recent "copying keys from photos" story:

http://www.jacobsschool.ucsd.edu/news/news_releases/release....

I find it interesting that this sort of snooping is now being attributed to 'hackers' - even making the fairly safe assumption that they mean 'crackers'.

Really, a lot of this seems to be plain old espionage of the type that you could easily imagine popping up in a 1960s spy serial. Interesting, for sure, but not really the sort of clever manipulation that you would normally ascribe to 'hackers'.

Now, the curious part of me wants to go off and think about whether this seemingly false attribution is indicative of anything more significant in the wider world... but the cynical part of me wants to seize the moment and start marketing super-high-end non-reflective eyeglasses to paranoid executives!

You can extract several bits of entropy per typed character from network traffic timing information. That's plenty to bring an exhaustive password-guessing attack down into the feasible range, if you have some way to know when a particular person is typing a particular password.

As a crude countermeasure, I leave about a second between adjacent characters in a password when I am typing the password over a network.

Hmm, go and read chapter five of lcamtuf's book "Silence on the Wire," part of which is incidentally available as a book sample:

http://www.nostarch.com/download/silence_ch05.pdf

wherein he gives this scenario a fair analysis (discussing signal encoding schemes, timing, and a DIY kit).

People have done papers on traffic-analysis breaks of secure protocols based on keystroke timing...

Reading data leaked via traffic LEDs was documented years ago at speeds up to 56kbps, with the expectation it would work at least up to 10Mbps; see this 2002 paper:

http://applied-math.org/optical_tempest.pdf

lo-tech Van Eck Phreaking, it seems