Instead of Hacker's Keyboard, I use Swype in combination with ConnectBot's onscreen control / escape keys. Swype has a hidden D-pad which makes using it on a fully touchscreen phone awesome.
> Doesn't that provide information about which usernames are valid, though? Or does that turn out not to matter?
Yes it does. A targeted attack would be able to get information out of that. A giant botnet spamming authentication attempts? They apparently don't even notice if their connections are being dropped, never mind the difference between valid and invalid usernames.
Instead of Hacker's Keyboard, I use Swype in combination with ConnectBot's onscreen control / escape keys. Swype has a hidden D-pad which makes using it on a fully touchscreen phone awesome.