1

Do you know of any existing mechanisms for keyboard-entry-obfuscation to defy keyloggers?

And if that exists does software such as (and in particular) VeraCrypt feature these?
If such mechanisms don't yet exist or if VeraCrypt doesn't feature such please also explain why that is the case. Isn't that essential to properly safeguarding the encryption-password?

(With keyboard entry obfuscation I mean random keyboard entries as noise over the actual keyboard input)

  • So how does the application knows what the noise and what the data are - and why can the keylogger not do the same? – Steffen Ullrich Jul 23 '17 at 20:19
  • @SteffenUllrich Because it has some mechanism to pick the actual input / to differentiate actual input from its self-caused fake input and the keylogger would have trouble doing the same as it's not what's causing the fake input and as it would need access to VeraCrypt's internal operation / data that is causing the fake data or conclusions about what's the actual input. – mYnDstrEAm Jul 23 '17 at 20:25
  • 1
    one technique i've seen works by showing a shuffled number pad on an LCD, used to map numbers to enter a PIN via the keyboard: since the number positions are dynamic, the same pin looks different to the computer each time it's entered; ex: the top-left number means 5 instead of 7. effective, but not apropos for normal keyboard usage. – dandavis Jul 24 '17 at 4:22
  • Where is the key logger? If it catches raw input from the keyboard remapping might work, but if it sits across the input to your application you'd need to remap inside the program. VeraCrypt is open source, so you might be able to recompile with some de-ofuscation inside. Getting the program and user to agree on a mapping while keeping the logger in the dark is a further challenge. – user123931 Jul 24 '17 at 15:47
4

There are no such mechanisms and the reason is that they would not be cost effective.

  1. The cost for such a technique is initially high because it is unclear how to realize it. You suggest that the receiver of a password somehow add noise to the input stream. For that you need the application that uses passwords to act a a keyboard. While this is possible it would still be a completely orthogonal extension to the application. In addition you would need to somehow emulate a keyboard in such a way that a keylogger cannot differentiate between the fake keyboards and the real ones. This might require operating system interference at a deep level depending on the system. All of this is extra implementation cost.

  2. The benefit of this method is actually not that great. When your system is running a keylogger that means it is running malicious code which can intercept keyboard events. This usually means that your system is completely compromised and while it would probably be a nuisance to attackers it doesn't actually diminish their power because they could also retrieve the passwords from memory.

And that's why this idea does not actually make it into practice.

  • 2
    So generally speaking, a keyboard obfuscator is solving an XY Problem. While sure maybe there's a way to obfuscate your key presses, but the general problem remains - you were hacked, or otherwise compromised, and it's better to solve that problem instead. – BruceWayne Jul 24 '17 at 5:33
  • 1
    @BruceWayne Yes, but if one could prevent people from stealing ones passwords even if one was hacked it would still be a major improvement and might also make a lot of things a lot easier such as the frequency by which one has to change passwords and accessing ones encrypted data without a high risk of password-loss from machines not under ones control. – mYnDstrEAm Jul 28 '17 at 16:57
  • 1
    @mYnDstrEAm There comes the 2FA. – mootmoot Oct 22 '18 at 14:02
  • 1
    @mootmoot I agree that 2FA helps against the password loss but it doesn't make using a compromised machine to access sensitive data a better idea. But definitely use 2FA, always use 2FA! – Elias Oct 26 '18 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.