[sophacles]

Keystroke timing attacks have been known for quite a while - heres a highly cited paper from over 20 years ago: https://www.usenix.org/conference/10th-usenix-security-sympo...

Recently there has been some work on using audio of keypresses to determine what's been typed: https://arxiv.org/pdf/2308.01074.pdf .

The statistical analysis described earlier works better when you have samples of a person's typing to try and learn whats been sent, but the acoustic work has raised some concerns that ML techniques can be used on just packet timings to determine what's been typed without a pre-determined signature. There's also concern that all that telemetry programs and sites send about you may be abused to build a signature of your typing patterns as well.