4 ms·
If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.
by akimbostrawman 2y ago
If a system used for logging in has a keylogger its game over anyways since it could just copy 2FA (excluding hardware token) or cookies.
- dharmab 2y ago2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.
- echoangle 2y agoHow would a keylogger steal cookies? There are hardware keyloggers that only record typed text.
- TeMPOraL 2y agoFor almost everyone on the planet, being spied on by a hardware keylogger is about as likely to happen as getting eaten by a shark. Security is important, but not the be-all, end-all. People really should get their priorities and threat models straight, and start counting in denial of service and data loss due to security system being incompatible with human beings as a cost.
- akimbostrawman 2y agoMost modern malware are software suits with multiple data extraction feature. Getting a hardware keylogger is extraordinary unlikely and at that point why not also consider video surveillance or evil maid attacks.