4 ms·
I suppose what they mean is that keyloggers / keylogger log analyzers can spot passwords by detecting unusual sequences of special characters or improbably long
by DrJokepu 17y ago
I suppose what they mean is that keyloggers / keylogger log analyzers can spot passwords by detecting unusual sequences of special characters or improbably long non-dictionary words. I'm far from being an expert at security but sounds like a reasonable concern to me.
It would be very interesting to hear the thoughts of some of the security expert HN-readers on this matter.
- memoryfault 17y agoNot to me. You shouldn't compromise the security of your entire system just to safeguard against certain keylogger scenarios.
- electromagnetic 17y agoAgreed, if you really want to prevent keyloggers simply stop online banking. That's never going to happen, so decreasing the security of your entire system is stupid.
- pierrefar 17y agoA secure password can be a correctly-capitalized and punctuated sentence. There is nothing reasonable about their concern.
- ErrantX 17y agoWell on the face of it it is a reasonable concern. But if the system has a keylogger there is very little you can do to protect your user. It is a very poor attempt at security through obscurity. If the users system is compromised there is nothing you can do. Sacrificing general security for that case is silly. The best defence to a keylogger attack is to have a secondary number vaidation alongside the password that requires you to enter a random subset of that number each time (eg 1st, 2nd, 8th).
- ghshephard 17y agoWell, to be pedantic, the best defence to a keylogger attack is a two-factor system. (RSA Fob, Smart Cards, and the like)
- ErrantX 17y agoWell yes you would generate the number those ways. The keylogger defence is actually in the random subset of numbers asked for. It completely destroys any attack it could make by never giving it a single complete picture :-)
- electromagnetic 17y agoIt's quite laughable really, if I'm logging into my bank I type HSBC.co.uk first, anything following that is my International Banking number, following that is my password (which is the best defence you state) and date of birth. If I was required to enter all 8 numbers my password would be the easiest thing to catch. The only better defence I can think is to have a user enter 3 genuine numbers from their password and 3 randomly generated numbers given to you, but it the 6 numbers are requested randomly. Requesting only random genuine numbers gives you encryption by hiding the sequence of the numbers, if you are also hiding the genuine numbers it's two levels of deceit.
- imajes 17y agowhich is what my bank does. (Lloyds).
- ErrantX 17y agoI wish hsbc gave you the numbers it wanted you to enter as images too. Makes it a little more difficult to parse.
- yannis 17y agoSome banks in South Africa used to bring up a little image keyboard and you click the letters (ie no keyboard) in my mind this is still one of the best ways to protect against keylogging.
- cliveholloway 17y agoStoring the password in a truecrypted file and copy pasting also works. Though, for someone going to those lengths, a keylogger is a very unlikely to be a problem for someone paying that much attention.
- aidenn0 17y agoA software key-logger can also typically snoop the contents of the clipboard.
- henrikschroder 17y agoTo log in to my bank online I need a browser certificate, my login, my 4-digit pin-code, and a 6-digit one-time random number from a little card my bank sent me. To get the browser certificate you need my login, my 4-digit pin-code, and another code the bank sends by SMS to my cell-phone. I love my bank, their authentication is cheap, platform-independent and reasonably secure. It's definitely safe from keyloggers, because it requires access to items that are in my possession. And best of all, it's not annoying for me as a user.
- epe 17y agoCare to share the name of the bank?
- henrikschroder 17y agohttp://skandiabanken.se http://skandiabanken.se