4 ms·

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.

fpoling 10y ago
Modern keyloggers track mouse and take screenshots on clicks.
- bruce_one 10y ago
  I know of some of those sites that randomise the location of keys and then hide the key labels on mousedown, I assume to try and avert that issue. (Curious as to whether it would actually work though.)
  - TheSmiddy 10y ago
    A hacker can get around that by also taking a screenshot when there is no mousedown event, it's literally one extra line of code.
    - fpoling 10y ago
      Or just take screenshots periodically each second and then submit with a mouse click the one before the click.
- joosters 10y ago
  It still doesn't work when the bank asks for different characters the next time you connect.
phlo 10y ago
It doesn't. Today's banking malware will capture the form values on submit, either as text or as a screenshot. And it will do so, silently, every time you log in. All this scheme does is limit an attacker to gathering three letters per login attempt. Given an eight-letter password, three logins will probably disclose most of it; or at least enough for an attacker to pass the challenge when he tries to log in. In addition, if the attacker is actually interested in your data, he can easily inject a fake "wrong password" message after your first attempt and have you try again, gathering 6 characters per login.