Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there anti-keylogging programs that can keep you safe while you are using a public PC terminal? Do they exist and what are these? I like to know that I am safe when entering data on a public PC for example from malware or keyloggers, who knows where it has been. Or else, how can I keep my personal data safe when using a public PC?

share|improve this question
4  
My android device... –  Rook Jun 27 '13 at 2:58
    
+1 @Rook My first thoughts exactly. Android and 2-part authentication (Where available). –  WernerCD Jun 27 '13 at 15:02

1 Answer 1

You can't ever be safe on hardware you don't control.

  1. A hardware keylogger could be mounted inside the chassis where you could not see it, or remove it.
  2. A software keylogger may not be detectable by any app that you could run (if you had enough user privileges to run any app).
  3. Network monitoring and sniffing of your web traffic would be completely undetectable.
  4. In a worst case scenario, the person who controls the machine also controls the root certificates installed on it, meaning they could also read your HTTPS traffic.
  5. Even if you were able to boot from "good" media, e.g. A Tails CD, you would still be vulnerable to #1 and #3 above.

The answers to How Do You Login From An Unsecured Computer? are also very good here.

I would suggest never using a machine you don't trust for anything that requires you to login. If you absolutely have no choice but to do so, hurry to a secure machine and change your passwords immediately afterwards.

share|improve this answer
    
You make some great points but I'm looking more on the lines of say writing documents on a public PC. Perhaps logging into a secure environment within the public PC terminal. –  Jason Smith Jun 27 '13 at 3:29
    
As for your points, (1) For my purposes, hardware keyloggers are not a problem since I can use any public PC. (2) There are programs (non-port) can protect you from keyboard-based keyloggers regardless whether detectable or not. (3) Not a problem with HTTPS. (4) It is a worst case scenario and quite an unlikely one as well. Besides, there are programs to detect certificate-based Man-in-the-Middle attacks very easily. For all the points you made, I get the impression it's fear-mongering more than anything else. I think it's a practical problem and there are very practical measures you can take. –  Jason Smith Jun 27 '13 at 3:39
1  
@JasonSmith The most practical measure you can take is not to do sensitive work on a public PC.... Whatever other measures you take you CANNOT be sure that it is working. –  Terry Chia Jun 27 '13 at 5:11
3  
@JasonSmith - hardware keyloggers can be obtained very cheaply. HTTPS can be MitM if you install fake trusted root certificates in the OS/browser. Granted, two-factor authentication and your own read-only media (ideally a CD/DVD/USB stick with a read-only lock set) would be secure. But really your best bet is to avoid public PCs. –  dr jimbob Jun 27 '13 at 6:26
3  
@JasonSmith: you appear to have already reached a conclusion for yourself, so why ask the question? You are dismissing each of this answer's points with no justification. There certainly are hardware keyloggers, there certainly are software keyloggers that can evade naive Windows hook listing, and there certainly are installations set up to monitor HTTPS traffic by having a proxy CA set up on the clients. We can argue about how commonplace those are, but if the question is how you can be safe using untrusted hardware the answer is definitely: you can't. –  bobince Jun 27 '13 at 8:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.