Hacker News Reader

Comment by noonespecial | Hacker News Reader

Assume that all computers that aren't yours are keylogged. When I must enter a password into an untrusted machine, I use the mouse to help me. My passwords are long non-words that I know well so I type part of the password, mouse to a different location, type some more, mouse some more, etc. (1) This should defeat key loggers and screen picture captures (if the password is starred) but still wouldn't defeat an out and out video of my session combined with keylogging. I figure that last scenario is a whole lot more rare.

1) My usual technique is to type the last three chars, mouse to the beginning of the field, type the next to last 3, mouse to the beginning, next 3 repeat till done.

View on HN

While defense in depth is never wrong, please be aware that even moderately advanced trojans will simply capture the contents of any form fields in most browsers. Neither your "skipping" technique, nor (partially) using an on-screen-keyboard will help against that.

Using a second factor for authentication provides some extra security, but a well-configured trojan might intercept your logout request, display a fake logout confirmation and store your session data for their botmaster to peruse.

If you need to regularly use untrusted machines (and have access to usb ports or a cd drive), you could bring a hardened browser with you. That should defeat most "Man-in-the-Browser" tricks. Or, even better, a live CD or USB drive. At this point, you should still assume your keyboard and screen to be compromised, but the OS should be safe enough to cautiously use.

In this scenario, if I login to my own server, if I control the login on the remote end, I set it up to support one time passwords. It would be nice if this would be something that can be set up by default for credentials.

Maybe this should be a feature request to the web-app devs.?

2FA with one-time codes is basically a one-time credential.

Use this site to support web apps with 2FA, or request 2FA for unsupported sites: http://twofactorauth.org/

Some services like Gmail allow you to sign out all other sessions from a session. So in the case of logging out from a unsecured computer, you logout as normal and then immediately sign out all sessions from your mobile device - it's a bit like a two factor logout to go with your two factor authentication.

Keylogger logs look like

    [Application $DATE_TIME]
    key that ii[backspace]s b[backspace]ein pressed

    [Other Application $DATE_TIME]
    Keys being pressed in other application

This makes the above technique useless. It would be useful if you were changing where you type in the same application/form.

> When I must enter a password into an untrusted machine

I have an "unsecure email account" that I mail boarding passes to (to print them at hotels).

You should never have to log in to a secure account on an untrusted computer. Why would you have to? Bad corporate policies or something?

>Bad corporate policies or something?

We have a winner. When I try to explain keylogging to them, they assure me that the vendor is first rate thanks to the money we pay and the webmail security is "unbreakable" on our system.

It's better to use one-time passphrases, I think.

Reply on news.ycombinator.com