Timeline for Is the data between a keyboard and a web browser secure from local computer applications?
Current License: CC BY-SA 4.0
29 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 20, 2020 at 19:47 | history | edited | Devil07 | CC BY-SA 4.0 |
added 3 characters in body
|
| Jul 30, 2019 at 19:35 | vote | accept | Devil07 | ||
| Jan 18, 2019 at 14:41 | history | edited | Devil07 | CC BY-SA 4.0 |
grammer
|
| Jan 17, 2019 at 1:40 | comment | added | Iron Gremlin | Best summary of all of this - The two most important layers of security are who has physical access to the device, and who has administrative access to the device. If the answer to either of those includes someone you don't trust, you can consider all use of the device potentially compromised. | |
| Jan 16, 2019 at 21:37 | comment | added | Delioth | @Devil07 : Always remember: if you're on an untrusted device, you can't even trust that the software you think you're using is actually the software you're using. How can you guarantee that when you open "chrome" you aren't actually opening my modified binary of Chrome that doesn't do any certificate checking and running a MITM attack on every client? Short answer is that you can't, because everything on the device could be compromised. | |
| Jan 16, 2019 at 20:55 | answer | added | KOLANICH | timeline score: 0 | |
| Jan 16, 2019 at 19:19 | comment | added | historystamp | If you are concerned about security, don't use an internet cafe. You best bet is to get a wireless plan and use it. Everything electronic generates electromagnetic radiation. There are folks around with the right equipment that can detect the electric signals from pressing different keys. You have to determine how valuable is your data and protect for what it is worth. | |
| Jan 16, 2019 at 15:19 | comment | added | Devil07 | My take-away is that MFA can protect my personal accounts, but there is nothing I can do on a public untrusted computer to ensure that my username/password isn't captured. Additionally, all of the information displayed in the HTTPS browser window on the untrusted computer can also be captured/recorded by the local computer. | |
| Jan 16, 2019 at 15:04 | answer | added | Daniel777 | timeline score: 1 | |
| Jan 16, 2019 at 10:15 | comment | added | Criticizing Israel not allowed | Note that your browser is a local computer application. | |
| Jan 15, 2019 at 21:07 | answer | added | user996142 | timeline score: 0 | |
| Jan 15, 2019 at 20:01 | comment | added | MichaelEvanchik | no, not unless you have a AVP that detects the common signatures of ways to capture keyboard input. End of question | |
| Jan 15, 2019 at 18:25 | comment | added | Džuris | @vlaz what if my pw is ´ertn2hu´ not ´hunter2´? :) | |
| Jan 15, 2019 at 15:23 | answer | added | iBug | timeline score: 2 | |
| Jan 15, 2019 at 14:36 | comment | added | VLAZ | @frarugi87 is that a sophisticated keylogger? I admit, I've only played around with one that I installed on my machine to see what it did. It my my first and last and it logged that kind of information, including which window you've clicked in when pressing any key and even the actual field or button you're interacting with. So, you'd know if you switched between Firefox tab with Wikipedia and then typing in the password field of a banking app. It could send that information through email or just dump it. That was 15 years ago - I doubt keyloggers have gotten less sophisticated since then. | |
| Jan 15, 2019 at 14:21 | comment | added | frarugi87 | [...] prince scam's same reasons). In any case, in my opinion the complexity of a keylogger in a public pc is not relevant. I consider any data I exchange on a public terminal as public, and so any time I want to access a service I don't want to be compromised I use only private terminals on private networks | |
| Jan 15, 2019 at 14:17 | comment | added | frarugi87 | @vlaz Yes, I was a bit quick in the comment, and so skipped a lot of details on "why" I thought it was fit for this. My comment was about the "escalation" of measures listed here. from a basic keylogger which captures the keys you write to one that tracks down all your activity and correlates it to extract the password you entered as a mixture of copy-paste, mouse movements and direct typing. This is technically possible, just like trying to hack the PC in the xkcd comic, but in my personal opinion nobody would waste time to gather just a couple of passwords more (for the "Nigerian's [...] | |
| Jan 15, 2019 at 13:09 | comment | added | VLAZ | @frarugi87 I disagree for this instance. There can be a lot of data harvesting that is totally viable to gather from a public PC. A Facebook password is very likely to be caught which...may have some value, or not. But more importantly, an attacker might be able to gather stuff like payment details. And the attacker need not be the owner of the public computer - it might be anybody who had access to it and decided to use it to harvest data. Public PCs don't tend to have a 4096 but RSA encryption. It might even be infected over the Internet without it being specifically targeted. | |
| Jan 15, 2019 at 13:00 | comment | added | frarugi87 | Well, this xkcd is particularly suited for this case I think... | |
| Jan 15, 2019 at 12:09 | comment | added | VLAZ | @pabouk that's a lot of variables that you can hardly account for. Sure, you can't even prove or disprove (easily) the existence, sophistication, and mode of operation of a keylogger however if untrusted, a foreign machine should be assumed absolutely compromised. This cuts down on the assumptions and possibilities you have to consider when deciding how to handle it. With this setup in mind, copy/pasting characters from a document is not safe the least and this misconception should not be perpetuated. | |
| Jan 15, 2019 at 10:18 | comment | added | pabouk - Ukraine stay strong | This strongly depends on the operating system being used - specifically how well it isolates individual applications (from each other and the shared components like keyboard) and how well it helps to apply correct access rights. --- Still even if the OS perfectly isolates the applications there are possible vulnerabilities or misconfigurations allowing unauthorized access. | |
| Jan 15, 2019 at 9:14 | comment | added | VLAZ |
@daygoor even if the clipboard isn't logged, I'd expect a keylogger on the machine itself to be able to say that you've highlighted and most likely also copied the individual characters. So in a log you might see highlight "h" -> Ctrl+C -> highlight "u" -> Ctrl+C -> highlight "n" -> Ctrl+C -> highlight "t" -> Ctrl+C -> highlight "e" -> Ctrl+C -> highlight "r" -> Ctrl+C -> highlight "2" -> Ctrl+C or something sufficiently similar to this. Even if you right-click -> copy, I'd assume a keylogger would note that.
|
|
| Jan 15, 2019 at 8:12 | comment | added | daygoor | If you are too concerned about key logging then open up any Wikipedia page, then copy and paste all characters you need to login ... but again maybe the clipboard is also logged! | |
| Jan 15, 2019 at 7:30 | history | edited | Anders |
edited tags
|
|
| Jan 15, 2019 at 0:13 | answer | added | Macil | timeline score: 23 | |
| Jan 15, 2019 at 0:00 | history | tweeted | twitter.com/StackSecurity/status/1084963536139370497 | ||
| Jan 14, 2019 at 19:45 | answer | added | bashCypher | timeline score: 85 | |
| Jan 14, 2019 at 18:58 | history | migrated | from crypto.stackexchange.com (revisions) | ||
| Jan 14, 2019 at 18:33 | history | asked | Devil07 | CC BY-SA 4.0 |