Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you copy/paste?

share|improve this question
1  
KeeForm (an addition to KeePass) can help make you more resistant to many types of keyloggers, it securely sends your password directly to the form fields in your browser. Unfortunately, this doesn't completely protect against keyloggers that actually scan the forms in web browsers. –  Adnan May 20 '13 at 19:19
4  
The clipboard is shared memory that can be accessed from most or all programs. You can imagine the rest for yourself. –  Gumbo May 20 '13 at 19:51
add comment

3 Answers

The point of keepass is not to prevent keyloggers. (Granted incidentally it will almost prevent hardware keyloggers; someone inserting a keylogging device between your keyboard and computer will not be able to observe a password you used once via cutting and pasting. It doesn't really succeed in this task though, as an attacker could trivially record your login details as well as the passphrase used to unlock your keepass file and then access all of your passwords).

It's main benefits are:

  1. Never reuse a password (every site has a unique password), so if a password at example.com is leaked your other passwords are not compromised. Never accidentally enter the wrong password at the wrong site if you can't remember which one you used.
  2. Easy to generate strong random passwords at each site; e.g., 20 random upper/lower/numbers/symbols for each site, without difficulty of copying, or difficult to remember to clear your history.
  3. Easy to protect with one global strong passphrase and keep in a strong encrypted file that you can back up and sync among your computers. (And it doesn't lock you into one web browser or OS).

The major downside is that you shouldn't have any applications that record your clipboard history while using keepass.

share|improve this answer
add comment

No, it is not a defense against key loggers. While it may protect against the most basic of key loggers, a smart key logger will hook in to the actual mechanism that enters characters (whether coming from the keyboard, an on-screen keyboard, or the paste buffer).

The only strong defense against key-loggers is some type of one-time method, such as a one time password. This also has to be coupled with a trusted connection to the server so that an attacker can't intercept the one time password or hijack the user's session. Good user education is also needed to ensure that users report if they attempt to connect and fail when their credentials were correct. (An attacker could present a valid challenge, get the response and then prevent it from going to the server if they have local control. They can then use the code to connect from their own system, but they would have to make it appear to the user that the connection failed.)

share|improve this answer
    
I can think of another strong defense against keyloggers. You know... don't get a keylogger in the first place! :) –  Terry Chia May 21 '13 at 1:00
    
@TerryChia not sure not getting them is a defense, but agreed it's probably the best practice. :) –  AJ Henderson May 21 '13 at 3:26
add comment

The Auto-Type feature of KeePass is very powerful: it sends simulated keypresses to other applications. This works with all Windows applications and for the target applications it's not possible to distinguish between real keypresses and the ones simulated by Auto-Type. This at the same time is the main disadvantage of Auto-Type, because keyloggers can eavesdrop the simulated keys. That's where Two-Channel Auto-Type Obfuscation (TCATO) comes into play.

TCATO makes standard keyloggers useless. It uses the Windows clipboard to transfer parts of the auto-typed text into the target application. Keyloggers can see the Ctrl-V presses, but do not log the actual contents pasted from the clipboard.

Clipboard spies don't work either, because only parts of the sensitive information is transferred on this way.

Anyway, it's not perfectly secure (and unfortunately cannot be made by theory). None of the currently available keyloggers or clipboard spies can eavesdrop an obfuscated auto-type process, but it is theoretically possible to write a dedicated spy application that specializes on logging obfuscated auto-type.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.