2

Are there anti-keylogging programs that can keep you safe while you are using a public PC terminal? Do they exist and what are these? I like to know that I am safe when entering data on a public PC for example from malware or keyloggers, who knows where it has been. Or else, how can I keep my personal data safe when using a public PC?

Improve this question
2
  • 5
    My android device...
    – rook
    Commented Jun 27, 2013 at 2:58
  • +1 @Rook My first thoughts exactly. Android and 2-part authentication (Where available).
    – WernerCD
    Commented Jun 27, 2013 at 15:02

1 Answer 1

Reset to default
14

You can't ever be safe on hardware you don't control.

  1. A hardware keylogger could be mounted inside the chassis where you could not see it, or remove it.
  2. A software keylogger may not be detectable by any app that you could run (if you had enough user privileges to run any app).
  3. Network monitoring and sniffing of your web traffic would be completely undetectable.
  4. In a worst case scenario, the person who controls the machine also controls the root certificates installed on it, meaning they could also read your HTTPS traffic.
  5. Even if you were able to boot from "good" media, e.g. A Tails CD, you would still be vulnerable to #1 and #3 above.

The answers to How Do You Login From An Unsecured Computer? are also very good here.

I would suggest never using a machine you don't trust for anything that requires you to login. If you absolutely have no choice but to do so, hurry to a secure machine and change your passwords immediately afterwards.

Improve this answer
6
  • You make some great points but I'm looking more on the lines of say writing documents on a public PC. Perhaps logging into a secure environment within the public PC terminal.
    – Jason Smith
    Commented Jun 27, 2013 at 3:29
  • As for your points, (1) For my purposes, hardware keyloggers are not a problem since I can use any public PC. (2) There are programs (non-port) can protect you from keyboard-based keyloggers regardless whether detectable or not. (3) Not a problem with HTTPS. (4) It is a worst case scenario and quite an unlikely one as well. Besides, there are programs to detect certificate-based Man-in-the-Middle attacks very easily. For all the points you made, I get the impression it's fear-mongering more than anything else. I think it's a practical problem and there are very practical measures you can take.
    – Jason Smith
    Commented Jun 27, 2013 at 3:39
  • 1
    @JasonSmith The most practical measure you can take is not to do sensitive work on a public PC.... Whatever other measures you take you CANNOT be sure that it is working.
    – user10211
    Commented Jun 27, 2013 at 5:11
  • 3
    @JasonSmith - hardware keyloggers can be obtained very cheaply. HTTPS can be MitM if you install fake trusted root certificates in the OS/browser. Granted, two-factor authentication and your own read-only media (ideally a CD/DVD/USB stick with a read-only lock set) would be secure. But really your best bet is to avoid public PCs.
    – dr jimbob
    Commented Jun 27, 2013 at 6:26
  • 4
    @JasonSmith: you appear to have already reached a conclusion for yourself, so why ask the question? You are dismissing each of this answer's points with no justification. There certainly are hardware keyloggers, there certainly are software keyloggers that can evade naive Windows hook listing, and there certainly are installations set up to monitor HTTPS traffic by having a proxy CA set up on the clients. We can argue about how commonplace those are, but if the question is how you can be safe using untrusted hardware the answer is definitely: you can't.
    – bobince
    Commented Jun 27, 2013 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .