Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Sometimes it happens that I have to access my email or some other web service from public machines. Are there any options to make it secure or at least reduce risks to acceptable levels? I am most worried about keyloggers. But even if can copy-paste password from somewhere there are still tools to intercept that. So there is basically no security by definition? One measure I can think about is two factor authentication, but it is not always available (for every service). Other possible measure is to have a server/machine somewhere and access it using some sort of remote access, but this requires considerable resources.

share|improve this question

4 Answers 4

up vote 21 down vote accepted

The usual recommendations about accessing private data from a public computer are:

  1. Don't do it.
  2. Don't do it; instead, use a smartphone or tablet.
  3. If your really must do it, there is no other choice, it would be life-threatening not to read your email, then the following mitigations can be used:

    • Use two-factor authentication (e.g. with Gmail), the second factor using your phone (presumed safe).
    • Use One-Time Passwords.
    • Change your password from a "safe" computer as soon as possible after the access.

    The first two mitigations suppose that you can enable these extra authentication methods on your Webmail, and that you have some extra device with you (a phone to send or receive a password by SMS, a generator for one-time passwords, a printed list of your next 20 one-time passwords...). The third mitigation depends on how soon you may access a safe computer, but, of course, if you can use a safe computer within the next five minutes, then why don't read your emails from that safe computer ?

In any case, whatever you do, you are betting that possible attackers won't hijack your connections automatically; instead, that the attackers passively gather passwords and won't do anything else immediately, leaving you with some minutes or hours to "plug holes". There are some attackers who act that way; but there also are other attackers who recognize connections to various Webmail systems and automatically hijack them. So, really, don't do it.

share|improve this answer
1  
Yeah, so I finally set up two-factor authentication for GMail, by the way they also have one-time passwords when you can't use the phone. But still I am slightly afraid of loosing phone and passwords and getting cut off from one of my main communication tools. –  Andrey Sep 17 '13 at 17:37
1  
@Andrey With Gmail, you can also store a cookie on any considered safe computer ("Stay signed in"), so that you could recover your account from there, once you lost your phone. –  Marcel Sep 18 '13 at 5:51

You could boot the workstation using a live distro or an OS installed on a USB key such as Ubuntu. But be sure there is no hardware keylogger and when you send sensitive information over the network be sure to use encryption using a trusted certificate.

share|improve this answer
    
This is usually not an option for public computers (hotels etc). –  Andrey Sep 17 '13 at 20:37
1  
To help provide a little more protection against hardware keyloggers, you could use an on-screen keyboard (although that makes you extremely vulnerable to shoulder surfers). –  AJMansfield Sep 17 '13 at 21:15
    
@AJMansfield shoulder surfers is manageable threat. –  Andrey Sep 18 '13 at 8:46
  • Install the PortableApps edition of Firefox to a USB thumb drive. This ensures you are using the latest version of Firefox. I am assuming the public computer you are using is running Windows.
  • Whichever online email service you are using, e.g. Gmail, turn on two factor authentication. Gmail now lets you use a smartphone app called Google Authenticator to generate a token, in a similar way to an RSA keyfob. This is used whenever accessing your email from a new (previously unseen) computer.
share|improve this answer
1  
How is having portable Firefox help me against key loggers? –  Andrey Sep 20 '13 at 11:43
    
@Andrey agreed it is difficult to detect keyloggers without some specialised software (or perhaps use a virtual keyboard?). But at least if you are using the latest version of firefox, this can prevent some other browser vulnerabilities. Many hotels and public computers have out of date browsers running, typically Internet Explorer. –  dodgy_coder Sep 21 '13 at 3:20

Use one time passwords. This requires you to be working on a service that supports one time passwords - I don't know of any, but I don't see any logical reason they could not.

share|improve this answer
2  
This is not very helpful recommendation, because as you said, they usually don't have OTPs. –  Andrey Sep 18 '13 at 8:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.