Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Sometimes i need to use a public pc to access my gmail account, is there a safe way to login and keep my password safe in case there was a keylogger or a trojan on that pc? are there tools that could help in that case?

share|improve this question

9 Answers 9

up vote 23 down vote accepted

Enable two factor authentication. Consider the remembered password compromised to any user of the public computer.

EDIT: My answer dealt with how to prevent your password from being keylogged. With two-factor authentication your password is now the combination of a randomly generated one-time use code (obtained via cell phone or pre-obtained list) as well as the remembered password; hence a keylogger doesn't give an attacker the ability to log in as you for a future attack.

However, I definitely agree with TomLeek and Nic that in a real-time attack (not a keylogger looked at after the fact) that captures your random session token (that indicates to gmail you are signed in before you do any action), an attacker can fully use your gmail account (send emails as you; search through emails sent to you; delete your emails; etc). Granted, once you logout your session token will become invalidated and will kick them out of your account. Granted a clever attacker could write a browser plugin to collect your session tokens, send it to them, and then redirect the logout page to not actually invalidate your token. Though you could always login to gmail again, view the link for "Last account activity [Details]" and sign everyone else out.

share|improve this answer
    
+1 for mentioning password exposure. the gmail account will be safe but the password won't be. –  ssg Feb 2 '13 at 16:34
4  
No, the gmail account is not safe. Using a One Time Password (two-factor) only protects the authentication phase. You are still vulnerable to session hijacking. –  Nic Feb 4 '13 at 2:47
    
I'll vote up Dr. Jimbob's response here. I like what he said, I think that there are some other tips, that are of good advice, but the tip provided here is most practical. I would just add that you can keep tabs on your account activity by logging in to your gmail, scrolling to the bottom of your account, to the bottom right there is "Last Account Activity" and a details link, which will show you where you are logged on from and give you the ability to sign out of all other sessions. –  Awhitehatter Feb 5 '13 at 19:08

If you turn on the 2-step authentication you can use a backup code, which is basically a one time use password.

share|improve this answer

If you are using public wifi you may consider VPN like Anonymizer. Refer to this link for more information: http://arstechnica.com/security/2011/01/stay-safe-at-a-public-wi-fi-hotspot/

share|improve this answer
3  
Won't help (and hopefully you'll not even e able to install it on a public PC) if the local computer/browser is compromised. –  phihag Feb 2 '13 at 16:30

I access my gmail from my phone, but occasionally need to get to an email from a public computer. An example would be printing tickets from a hotel business center.

I keep a separate gmail "dropbox" account for this purpose... I just forward the relevant email using my phone to my "dropbox" email account and then access that account from a public computer.

myname@gmail.com mynamedropbox@gmail.com

I don't fret about exposing the password for my dropbox email account since its almost always empty.

... But I still use google's 2-factor authentication for my main account.

share|improve this answer

There are some inherent risks to consider, even if you can use a one-time password. Google Accounts is big and important, so there's a risk that Google may be targeted specifically.

I expect that a compromised system could change your GMail settings to forward a copy of every mail you receive from then on. (As well as reading all your old email while you're logged in there). It would then be able to gain access to other accounts e.g. facebook (I think), or a blog account. By using the "forgot my password" feature to request the other account to send a new password to the registered email address. Which the attacker could then read.

I expect they could even change your GMail settings to define a filter, which deletes the "here is your new password" emails after they've been forwarded, so you wouldn't notice those emails. (You would only notice when you tried to log in to the other account, your original password didn't work, and you're not able to use the "forgot my password" feature because the "here is your new password" emails are still being filtered).

The "forgot my password" attack is probably not a huge issue. It's probably going to be spamming, like the facebook/yahoo account hacks that happen, and the pain is more from having to clean up the mess, rather than any significant harm.

Google might mitigate this as well. E.g. for the more stealthy variant: If a user changes their forwarding settings while logged in from a new computer/browser (or perhaps even an old one), then the next login on each other computer/browser(s) could tell the user about the forwarding changes.

share|improve this answer
2  
+1 Regardless of whether you're using strong authentication, the untrusted host can still act on your behalf. –  Nic Feb 2 '13 at 18:56

Stricto sensu, the only way to keep your private data private while accessing it on a potentially compromised public PC is to pray. If the PC is indeed compromised, then the villain who controls it now knows everything you typed and saw and downloaded and uploaded through that PC, and that includes, of course, your password. You will be safe only if the attacker, through laziness or incompetence, elects not to bother with your account. Gmail's two-step verification, which dr jimbob mentions, will somehow contain the damage in that the stolen password will not be sufficient to easily connect again on Gmail; but for the duration of your session, your Gmail account was nonetheless a free-for-all fair.

Also, if you can use Gmail's two-step verification, then you have a phone -- make that a smartphone and you will be able to access your emails from the phone alone, totally bypassing the PC of dubious cleanliness.

share|improve this answer
    
I do wonder how exposed that leaves you when the smartphone is lost/stolen :). OTOH, that may be a more well-understood threat (by users as well as service providers). –  sourcejedi Feb 3 '13 at 10:05

Logging into email (or any other service) from a public PC is risky. Of course you need to use strong authentication. But also, you need to consider whether the host is a trustworthy actor. When you authenticate yourself, you are effectively delegating access to the host you're using. Consider these attacks made possible on an untrusted host.

  1. The list of trusted certificate authorities could be modified to allow man-in-the-middle attacks against common websites like gmail.com.
  2. Malware in the browser could intercept your browsing and perform extra actions on your behalf, such as creating mail rules and/or exfiltrating mail messages.

So what can you do about a public PC that can't be trusted? You need to decide which parts of the system you can trust. You can probably trust the CPU and memory in a public PC as much as you can trust your own personal computer. But the operating system and browser are much easier to attack, so you trust them less. Here are some ways to mitigate the common risks.

  1. Install Portable Firefox on a USB drive so you know that the list of certificate authorities has not been tampered with. (Bonus points if the USB drive can be made read-only with a hardware switch).
  2. Bring your own bootable CD-ROM or USB drive with something like a Linux LiveCD or Windows To Go.

And for bonus points, here are some things that developers can do to improve application security.

  • Allow users to generate single-use passwords for limited access to the service. For example, this could be used for read-only access, or time-limited duration. Basically, use alternate authentication that applies more strict access controls.
  • Force users to re-authenticate for privileged actions. (Gmail already does this for some actions.)
share|improve this answer
2  
good advice, but this mostly doesn't consider hardware keyloggers that can be built into the keyboard or subtly inserted. And most public PCs probably do not look too kindly to booting up into another OS or running a random program from a thumbdrive. –  dr jimbob Feb 4 '13 at 15:23
  • Use Chrome Incognito Window <Ctrl>+<Shift>+N,
  • or Firefox Private Browsing <Ctrl>+<Shift>+P,
  • or god forbid you need to use IE InPrivate Browsing <Ctrl>+<Shift>+P,
  • or Safari Private Browsing Make your own shortcut
  • etc
share|improve this answer
1  
Mmmm, just saw the part about the keylogger, sorry. –  Akahadaka Feb 3 '13 at 10:07
1  
Good (practical) idea, if you bear in mind the caveats on other answers. For a "sometimes" thing, it might be easier to remember the menu location though. Rather than keyboard shortcuts, on an unfamiliar browser. –  sourcejedi Feb 3 '13 at 10:11
1  
-1 This is private browsing not safe browsing. Remember that with an extension you can store all kinds of information. –  RTOSkit Feb 3 '13 at 13:33
1  
@RTOSKit private browsing disables extensions for this very reason, at least in Firefox and Chrome –  sourcejedi Feb 5 '13 at 14:53
    
@sourcejedi absolutely not true! You may have also enabled extensions in private mode. besides that also a baby SK could have a recompiled version of any gecko or webkit open source, and make fake your private environment. –  RTOSkit Feb 5 '13 at 19:03

My solution to this problem at university where the computers were constantly becoming infected with flash driver viruses and trojans. Was not to use the installed system. When you have put hundreds of hours into your projects you can't take a chance the the computer you are connecting to is just going to corrupt and destroy all that work.

I would carry a boot able live cd / or usb drive of one of the thousands of Linux operating systems. I would boot into a working Linux operating system and do what ever I need to do with out mounting / using the infected / compromised internal hard drive. This limited my exposure to the malware that could potential be found on the internal disks.

You may need to ask for permission to do this at a internet cafe, or library. It should not be that difficult to do. Most live disks give you a web browser, Libra of Open office for reading an writing most office documents. On bootable usb drives you can install software and have it there the next time you boot up.

One of the only post configuration issues I had at university was setting up the network connectivity so I could browse the internet. The university had set up a proxy server that all the computers used to access the internet. You will need to find which of these settings apply to the public computer systems you are trying to access. It would probably be helpful if you use the same public computers systems over and over to save these types of settings in text file on a flash drive that you carry with you. Bootable flash drives give you some control over which settings you want to save to your disk. I currently use the ubuntu 12.04 lts bootable usb drive.

http://www.ubuntu.com/download/help/create-a-usb-stick-on-windows http://www.ubuntu.com/download/help/create-a-usb-stick-on-mac-osx http://www.ubuntu.com/download/help/create-a-usb-stick-on-ubuntu

http://en.wikipedia.org/wiki/Live_CD

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.