Hacker News Reader

Comment by baby | Hacker News Reader

I've always been scared about keyloggers in internet coffees or public computers in university/hotels. I really wonder if there's a way around. Especially since, if you can scan this with your cellphone it supposes you have internet on your cellphone.

View on HN

Here's a trick: as you are typing in your l/p, click somewhere on the screen to defocus the textbox and then type some random characters and then click back on the textbox. And also type random characters into the textbox, and then select them with the mouse and overwrite them with correct characters. Do this a bunch. Almost all keyloggers just log all key strokes, then people scan for stuff that looks like "john@example.comLkd98/x,". There's still the chance that your internet cafe has a more sophisticated logger on it. But if you do this you've made a real step to fight keyloggers in internet cafes.

This, along with copying a character from the clipboard, won't defeat most keyloggers. The only kind you would be fooling would be a hardware keylogger. Your best bet is two step authentication.

Care to explain why it wouldn't defeat most keyloggers? My knowledge of this is that when you look at the log created by the keylogger you just see a bunch of keystrokes but you have no way to tell if they were typed in the same field.

The two step identification doesn't work if you don't have internet on your phone right?

If I was writing one I'd just be logging posted form fields with a transparent proxy, almost seems easier than a key logger.

Except that doesn't work if the form posts to a HTTPS URL. You'd have to implement something at the browser level, e.g. installing a modified browser or a browser extension.

It is possible to perform a MITM attack on HTTPS when you can install any certificates you want in the web browser.

For google, I turned on two-factor authentication. The provide an iOS/Android/Blackberry app that acts like a secureId (provides a different security code every 30 seconds).

The phone app could be also be used for your own projects. It supports multiple accounts and either manual or QR-code based configuration.

Google provides a PAM module so you can add 2-factor auth to ssh. And it is easy to implement the standard on the server side, if you want to add 2-factor auth to your web app.

For more info, see:

http://code.google.com/p/google-authenticator/

google also offers two-factor authentication

I switched from Gmail to FastMail partly because they offer neat features like one-time passwords. (Two-factor auth with SMS - which FM also has - is nice but not always convenient/possible.)

You choose a "base password" (different from your master password) and it then generates 100 one-time passwords that you can print out and put in your wallet. So to login, the password you enter is "<base password><one-time password>". Works great. You can also make it restricted so that one-time logins can't delete anything, or change any options.

Gmail supports 2-factor authentication as well: http://support.google.com/accounts/bin/static.py?hl=en&t...

It works by requiring your normal password, plus a one time password that can either be SMS'd to your phone, generated by an Android app, or one on a list that you've pre-printed and keep in your wallet.

Cool, didn't know you could pre-print lists. I think I prefer the FastMail way though. With Google, as I understand it, 2-step authentication is either on or off; you have to use it all the time, or not at all. (Application-specific passwords are an exception but not relevant to the issue with keyloggers and public computers.) With FM, you can always sign in with just your master password, _or_ totallydifferentpassword+one-time-password (and you can have multiple sets of alternative logins).

I don't want to deal with 2-step authentication on devices I trust (e.g., my encrypted laptop). I could switch it on and off every now and then, but with Google I'd always be typing my normal password (for me, generated by KeePassX and impossible to memorize) when doing the 2-step thing, right?

The "Remember me" feature works normally. There's a "remember this computer for 30 days" option that sets a cookie on the computer so that you aren't prompted for the one-time password again, just your regular one (if "Remember me" is turned off).

I actually really like this idea of a one time password being equivalent to a remembered session based on a cookie.

You get read only access with your OTP, and if you want to do something destructive or otherwise important, log in again with stricter authentication.

Making all of your account available all of the time from one basic login seems like quite a bad idea for a sensitive account.

You can sign in without username and password to OpenID enabled sites with your smartphone and Mepin; https://www.mepin.com/

Reply on news.ycombinator.com