46

My bank has issued a new version of their online banking site. This new version has no virtual keyboard to enter the PIN. I asked them how are they protecting me against keyloggers but I didn't receive any answer.

  • 40
    the question is: did they protect against keyloggers before? For example: raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity – schroeder Oct 25 '17 at 14:37
  • 54
    Are talismans not necessary anymore to protect against evil spirits? – CodesInChaos Oct 25 '17 at 19:19
  • 5
    My Dutch and British banks have both issued me separate token generators (e.g. PINsentry) into which one enters the PIN, which solves the problem better. – PJTraill Oct 25 '17 at 19:22
  • 10
    Why do you think it's your bank's responsibility to protect you from keyloggers? Keylogging means your computer is compromised, not its. – Justin Lardinois Oct 25 '17 at 22:12
  • 4
    I've never seen a virtual keyboard in a banking site. Is this more common outside the US? – Barmar Oct 26 '17 at 4:11
85

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers.

But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks).

In the end, it is not clear that a virtual keyboard provided any broad benefit. It would certainly defeat a hardware keylogger installed on your keyboard, but that's not the likely threat.

Given that keylogging software expects to also capture virtual keyboards, there is little benefit to maintaining this technology in the broad, likely scenario.

Tests have been done on the effectiveness of virtual keyboards:

https://www.raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity/

  • "It would certainly defeat a hardware keylogger installed on your keyboard" It would also defeat software keyloggers; filtering for bank url followed by enter, followed by X, followed by a click or enter is much, much simpler to do in a generic way than the framework needed to inspect a specific virtual keyboard and its entry actions. – pmf Oct 26 '17 at 8:02
  • 5
    @pmf unless the virtual keyboard pretends to be a keyboard driver and you are back at square one with regards to software keyloggers. – ratchet freak Oct 26 '17 at 9:09
  • Again, the virtual keyboards of banks are implemented on web stack, and just listening for keystrokes won't give you the password. Taking screenshot doesn't work with my bank for example, as they change all characters to * when a key is pressed, and they scramble key positions after each keypress. Surely some keyloggers might adapt to that but not most. I personally don't use the virtual keyboard but it's probably at least OK when fighting against keyloggers. – Ave Oct 27 '17 at 7:05
  • 1
    @Avery sure, and the testing link I included showed that some types of keyloggers are effective. My point is about 'broad benefit'. – schroeder Oct 27 '17 at 10:30
  • Just because a solution is only a partial security improvement, this still does not convince me why it was abolished. IMO, for even a partial security improvement to be abolished, there should be some clear indication of whether there was any harm done by it (or excessive effort...). – AnoE Oct 27 '17 at 14:49
20

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros:

  • they protect the password from naive keyloggers
  • they prevent the user from storing the password in a file

But they do have cons:

  • specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation)
  • then prevent usage of complex passwords (12 to 20 random characters) stored in a decent password manager like keepass

As far as I am concerned, I do not like them because of that. But I must admit that they may add some security for non-security-aware users. The problem with them is that as they require a rather weak password (at most 6 to 8 digits), the bank could be blamed in case of compromise.

With standard passwords, users can choose a strong password (and are advised to do so). So if they do not, they are fully responsible in case of compromise and cannot blame the bank.

  • 6
    why does a virtual keyboard prevent the user to store the password in a file? The user could still store it somewhere and type it in. – Lukas Oct 25 '17 at 20:13
  • 2
    I'm so glad my bank uses 2 factor auth using the chip card they issued to me instead of that kind of crap. – ratchet freak Oct 26 '17 at 15:39
3

One of the motivations behind a virtual keyboard was the risk posed by the usage of pc's in cyber cafes, kiosks etc by users to access banking websites in the past and reliance on password based authentications...With more users now having a mobile/personal devices that risk has come down.Some banking sites would have both options and provide recommendation when to use which.Large scale usage of multifactor/out of the band authentication/verification for banking transactions has also reduced the risk.

If you have a keylogger installed on your machine you have bigger problems.With advanced keyloggers a virtual keyboard is not very effective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.