My bank has issued a new version of their online banking site. This new version has no virtual keyboard to enter the PIN. I asked them how are they protecting me against keyloggers but I didn't receive any answer.
-
40the question is: did they protect against keyloggers before? For example: raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity– schroeder ♦Commented Oct 25, 2017 at 14:37
-
54Are talismans not necessary anymore to protect against evil spirits?– CodesInChaosCommented Oct 25, 2017 at 19:19
-
5My Dutch and British banks have both issued me separate token generators (e.g. PINsentry) into which one enters the PIN, which solves the problem better.– PJTraillCommented Oct 25, 2017 at 19:22
-
10Why do you think it's your bank's responsibility to protect you from keyloggers? Keylogging means your computer is compromised, not its.– user2752467Commented Oct 25, 2017 at 22:12
-
4I've never seen a virtual keyboard in a banking site. Is this more common outside the US?– BarmarCommented Oct 26, 2017 at 4:11
|
Show 3 more comments
3 Answers
Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers.
But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks).
In the end, it is not clear that a virtual keyboard provided any broad benefit. It would certainly defeat a hardware keylogger installed on your keyboard, but that's not the likely threat.
Given that keylogging software expects to also capture virtual keyboards, there is little benefit to maintaining this technology in the broad, likely scenario.
Tests have been done on the effectiveness of virtual keyboards:
https://www.raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity/
answered Oct 25, 2017 at 14:52
-
"It would certainly defeat a hardware keylogger installed on your keyboard" It would also defeat software keyloggers; filtering for bank url followed by enter, followed by X, followed by a click or enter is much, much simpler to do in a generic way than the framework needed to inspect a specific virtual keyboard and its entry actions.– pmfCommented Oct 26, 2017 at 8:02
-
5@pmf unless the virtual keyboard pretends to be a keyboard driver and you are back at square one with regards to software keyloggers. Commented Oct 26, 2017 at 9:09
-
Again, the virtual keyboards of banks are implemented on web stack, and just listening for keystrokes won't give you the password. Taking screenshot doesn't work with my bank for example, as they change all characters to * when a key is pressed, and they scramble key positions after each keypress. Surely some keyloggers might adapt to that but not most. I personally don't use the virtual keyboard but it's probably at least OK when fighting against keyloggers.– aveCommented Oct 27, 2017 at 7:05
-
1@Avery sure, and the testing link I included showed that some types of keyloggers are effective. My point is about 'broad benefit'.– schroeder ♦Commented Oct 27, 2017 at 10:30
-
Just because a solution is only a partial security improvement, this still does not convince me why it was abolished. IMO, for even a partial security improvement to be abolished, there should be some clear indication of whether there was any harm done by it (or excessive effort...).– AnoECommented Oct 27, 2017 at 14:49
Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros:
- they protect the password from naive keyloggers
- they prevent the user from storing the password in a file
But they do have cons:
- specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation)
- then prevent usage of complex passwords (12 to 20 random characters) stored in a decent password manager like keepass
As far as I am concerned, I do not like them because of that. But I must admit that they may add some security for non-security-aware users. The problem with them is that as they require a rather weak password (at most 6 to 8 digits), the bank could be blamed in case of compromise.
With standard passwords, users can choose a strong password (and are advised to do so). So if they do not, they are fully responsible in case of compromise and cannot blame the bank.
answered Oct 25, 2017 at 15:41
-
6why does a virtual keyboard prevent the user to store the password in a file? The user could still store it somewhere and type it in.– LukasCommented Oct 25, 2017 at 20:13
-
2I'm so glad my bank uses 2 factor auth using the chip card they issued to me instead of that kind of crap. Commented Oct 26, 2017 at 15:39
One of the motivations behind a virtual keyboard was the risk posed by the usage of pc's in cyber cafes, kiosks etc by users to access banking websites in the past and reliance on password based authentications...With more users now having a mobile/personal devices that risk has come down.Some banking sites would have both options and provide recommendation when to use which.Large scale usage of multifactor/out of the band authentication/verification for banking transactions has also reduced the risk.
If you have a keylogger installed on your machine you have bigger problems.With advanced keyloggers a virtual keyboard is not very effective.
