"Tell me how well they do trying to capture userid/password combinations from a building with 1000 running keyboards when the pair of values is not entered together or in the same order."
First off as they have not published (and may yet not due to peer review) so we do not know how "they" do it.
However to answer your compound question you first need to accept that you are asking across two entirly sperate problem domains.
Firstly off, as far as I can see the researchers are not claiming to be able to pull one keyboard out of thousands at great distances.
Secondly they are not claiming to do any data analysis to show usernames or passwords.
All thay appear to be claiming is nothing other than being able to read the keystrokes by compramising eminations at a short to moderate distance (20 meters) which is actually quite pitiful to what can be acheived if you want to.
You need to remember Bruces comments about "attacks get better with time" that is they start off as being assumed impossible, become theoreticaly possible, move on to being just demonstrable, to becoming practical then every day.
In this case the researchers belive thay are at the "just demonstrable" stage, the reality is we are way beyond that as I will describe.
To answer the direct parts of your compond question it needs to be split up into three questions,
1, username / password,
2, intercept range.
3, target isolation.
That cover two problem domains.
The first question and problem domain is simply to do with the data intercepted and not the how. With regard to the username / password you need to ask yourself a question,
"Does an attacker actually need the username and password for the CEO's PA or any other employee for that matter to gain valuble information?"
The obvious answer is not unless they wish to crack into the users account, which is these days quite low on the list of things either an industrial spy or penetration tester is trying to acheive. Especialy as cracking is an active activity with significant risk of detection and significant penalty if caught and prosecuted which is quite likley.
Whereas passive evesdropping (apart from on Government Orgs) is almost impossible to detect so infrequently prosecuted and the punishment handed out so minimal that it is not realy considered a hazard.
And in the case of a CEO's PA it is likley to be obvious when she is typing up a letter or memo or email, and usually to who. Therefore it is likely you will have the information before the recipient, and is extreamly timley and therfore of much higher value in an ongoing negotiation etc (which is what a lot of industrial spying is about).
Which brings us on to the second problem domain and it's two questions of,
2, intercept range.
3, target isolation.
I suspect the paper submitted (if it is ever published) does not cover these and if the researchers have considered it they are holding it in reserve. And not for any desire to withold information to prevent practical attacks but simply out of self interest (in which case I'm going to be spiking their guns with this post).
You need to understand a little about modern research publication as to why they may wish to do this.
The old truisum about "publish or be dammed" is not the only constraint for the success of a researcher these days. Unfortunatly it is now more a question of "quantity over quality" unless you have an established name.
This gives rise to reseachers "serialising research findings" so rather than one good information or method rich dense paper you get many information light papers spaced fairly rapidly over time. You could call it "sound bite research" in that it gives the researchers names more hits in journal and citation databases thus improves their ranking (just like Google hits).
This has consiquences where the researcher puts as little into a paper as they think will get it published (or possibly not as is currently the case with their paper).
Which means that you will usually only get a single method or finding given in each paper. Which in some cases is actually an advantage to others, as it gives you the chance to jump in with a "method improving" or "method diversifing" paper of your own (which I strongly suspect is what their paper is).
In this case I'm guessing that the researchers have gone for "method diversification" of work done by Marcus Khun at Cambridge Labs. And not particularly "improving techniques" and have basicaly regurgitated an existing method on a new target and the peer review process has come back saying "insufficient originality" for publication (effectivly the equivalent reason why many secondary patents get rejected as "prior art").
Anyway back to the second problem domain,
The laws of physics work both for and against you on this but interestingly not in a linear way so there are "sweet spots" and "sweet techniques".
In the case of compramising emissions you have a number of things against you,
The first being that the energy in a "plane wave" decressess as an inverse square law, that is to double the range you need four times the emission energy.
Secondly the noise rises as the RMS of the unit energy per unit of bandwidth that is if the bandwidth is doubled then the noise floor is 41% higher.
Thirdly plane wave radiation is usually considered to be from a point source, with the E and H fields being orthagonal and the radiation being omnidirectional. This is most certainly not true in the near field where all sorts of interesting things happen, and consiquently things that interreact in the near field have significant consiquences on the far field think directional antennas as a practical everyday example (any way more on the devistating effects of near field attacks later).
These issues are the same for intentional emissions so are fairly well known discussed and documented.
However then you have the effects going in your favour, which oddly under normal (ie non EmSec / TEMPEST use) conditions most of these are considered disadvantages and are thus discounted in the general body of knowledge as advantages.
First off in this area is harmonic radiation. Few if any signals when generated or amplified are harmonicaly clean which is why most transmitters have quite a few tuned circuits to reduce harmonics below a either a given level (35uV into fifty ohms) or relative to the mean carrier output (ie -80dBc). As I noted in one of my posts above you can use harmonic radiation to reduce the effective noise floor.
That is when you sum two or more coherant signals together the wanted signal goes up linearly, the noise however being non coherant only rises as the RMS value (ie root n). Therfore if you sum the first 9 harmonics the wanted signal level rises 9 times but the noise floor only three times thus giving you an overal advantage of three to one (or root n).
However you will be told that the voltage or current level of harmonics on digital waves goes down as 1/n [power drops as 1/(n^2)] in a (frequency independant) resistive load. And as the even order harmonics are assumed to have no energy, half the signals power is in the harmonics.
Which sugests that the summing of harmonic signals will not be that advantageous. However this is very far from the truth for several reasons.
The second advantage is that the radiation efficiency of a conductor of any given length goes up with frequency. The relationship is complicated but it tends to make up for the 1/(n^2) issue of harmonic energy. Which means that there is in all probability a "sweet spot" of harmonics that is related to the length of the conductor, which is how it turns out in practice.
Thirdly is noise floor you normaly get told -174db / Hz, is the noise floor below which it is not possible to pull a signal out, and for some unacountable reason this appears to be treated as a "law". It's actually the thermal noise in a 1Hz bandwidth at room temprature so it goes up with bandwidth and drops with temprature (as evidenced by hot and cold resistor testing to get the real noise floor of a low noise amplifier).
Further as indicated above there are practical ways around it which do not break the laws of physics (ie average in the frequency domain and also average in the space domain and in some cases the time domain as well).
As well as apparently forming a "law" in peoples heads it also appears to get translated from "noise at the reciever input" to a general case...
Even though it is practicaly obviously that it is not the case. Antennas give (almost) noise free gain which is only practicaly limited by the effective apature of the antenna that is usually related to it's physical size and the frequency of operation (the higher the frequency the larger the gain for any particular physical size).
However there appears to be a general assumption that the noise floor at a receivers input is directionless.
This is simply untrue even for cosmic noise, when in use a receivers noise floor has little or nothing to do with the thermal noise floor. Most of the noise is from point sources such as other electronic equipment etc.
A similar RMS effect works with two or more antennas and is usually called "space diversity". Usually it is assumed it is used to average out noise which is directionless and therfore of minimal benifit. Well if the antennas have directionality as well this gives a further boost to the wanted signal.
But more importantly you can also use antennas to null out unwanted signals. Often the nulls loss on an antenna is significantly greater than any gain it might have.
An old example of this is using a loop and whip antenna together for direction finding. The combined pattern is a cardiod where the null on an otherwise omnidirectional pattern can be 40dB or more, where as the combined gain is only a couple of dB up, such an antenna could easily be used to remove one considerably stronger interfering signal to negligable levels. Combine it with space diversity and you start to get a very powerfull tool.
Then there is the long base line effect. The further apart (in wavelengths) two antennas are the more "effective point source gain" you have. This effect is seen in radio / optical astronomy etc. Suffice it to say when done properly it can pick a very weak distant signal out from many stronger adjacent interfering signals. The longer the base line and the more antennas there are the better the discriminating ability (space diverstiy is now on Uber Steroids).
A combination of these effects can all be used to make the desired keyboard stand out like a search light in a sea of candles and or give an increased range...
Finally there is the non plane wave or near field to be considered. It is an area that is not normaly talked about in general radio courses and often only in passing in EMC courses. However in EmSec it's realy the over riding area of interest.
Traditionaly the near field is effectivly a zone between the effective antenna apature and two wavelengths out. The area is where the E and H fields sort themselves out and transition into the orthaganal plane wave. The power loss between the antenna feeds of a radiating antenna and recieving antenna at the edge of the near field is something like 20dB or 100:1
However if the radiating elerment is not actually an antenna things become much more complicated. For instance, if there is a continuous conductor that passes through the near field then it will carry the signal along it's self for many many times the expected free space distance (look up a G-wire transmission line).
An example of this is the old cordless phones that worked at 1.8MHz if the transmitter was close to say a farmers fence or overhead power or telephone lines then the signal could (and has) been usable at 10-20 miles which is a lot lot further than the 50-100 yard range it was supposed to have as a maximum (aprox equivalent to a 32dB increase in power).
You need to remember that the CPU in a keyboard often runs at around 2MHz and usually there are telephone / power / network cables directly adjacent to it. Further that metal structure in the desk and architecture such as rebar in concreate or RSJs power / lighting / alarm cables in walls ceilings and floors and even shielded telephone and network cables all fall well within the near field of the keyboard.
In the case of shielded cables this is something that works against the defender and very much for the attacker.
Shielded cables are designed to keep signals in the cable which they do quite well and also to keep signals out. Likewise twisted pair cables due to their differential signals do not tend to radiate. Often you will see shielded twisted pair cables used which realy do stop signals being radiated from the twisted pair cable inside.
So people unversed in the ways of EmSec will add that extra "shielded magic" to their design.
Obviously a shielded cable has a large external diameter it's radiation resistance (and therfore succeptance) is considerably lower than the wire in a twisted pair. Therfore if it goes into the near field it will not only pick up a lot more it will carry it further and radiate it better than the unshielded twisted pair, Opps...
To understand more lookup how Gamma matches and loop antennas work it might make your mouth drop when you look around the average office.
Then there are other less well known effects such as "signal cross-coupling" a form of leap froging, where a signal starts in one conductor, gets coupled (jumps) into another, and likewise into others.
So desk frame to floor rebar, to wall rebar to external metal drain pipe etc....
Then there are strange effects to do with cross modulation and signal piggybacking. If you have an electrical conductor carrying a signal with modulation on it, another unrelated signal that shares the conductor will under some circumstances get the modulation superimposed on it.
One of these effects that can guite easily be induced is "paramteric amplifiction" (google paremetric amplifier if you want to know how the amplification and cross modulation works).
Basicaly If I direct a signal ot ten or twenty times the frequency and approximatly the same power up into the conductor and there is a nonlinear component such as rust or metal oxide making a nonliner junction (ie like a diode) then the modulation will not only transfer to the higher frequency it will be considerably amplified as well. Even better from an attackers point of view the effect can be further magnified by picking a frequency that the conductor is reonant at.
Now a keyboard cable has active semiconductor devices at either end which give you two nonlinear devices, and will be resonant in the VHF band. So If I point a VHF directional antenna at the office I want to monitor and tune around I stand a very good chance of iradiating the keyboard cable and of bringing it to resonance.
But how do I know I've done it, well actually quite simply, I listen with another directional antenna to a harmonic of the frequency I am using, any conductor with nonlinear components on it will sing out at the harmonic frequency (that's how a lot of those "store protection" tags work, especialy thos in books).
If this receiving antenna is in a different location simple triangulation enables me to cross point the axis of both at my targets position using two or more of these harmonic receivers with space diversity and I have your keyboard dead in the water waiting for it to deliver up it's precious treasure...
Oh and the range is dependent on how much power I inject into the keyboard cable. But at VHF even 1mW will radiate several hundreds of meters from a resonant antenna (which the keyboard cable has become). Oh and in practice you can get anything upto 500mW if the frequency is high enough and at UHF with a low information bandwidth that could go over two hundred miles line of sight....
And there are other techniques where it could go a lot further for less power so reducing the probability not only of you being discovered but also of mucking up the keyboard or PC behaviour.
So the answer to your questions are,
Q1, Username / Password
A1, Effectivly irrelavent in a lot of cases.
Q2, Intercept range.
A2, purley pasivly maybe 100meters activly maybe a mile or two line of sight.
Q3, target isolation.
A3, it depends on the number type, gain and base line of the antennas you use in the receiver, and in an active attack on the gain and position of the transmitter antenna as well.
But yes it's quite easily doable and not at that much cost if you know what you are doing.
And as I have pointed out none of this is Secret information it's all in the public domain you just have to piece the bits together (which for some strange reason few ever seem to do).