Are auto-type features of password managers actually effective against keyloggers?

Question

Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging keys" anymore, and they can even follow mouse movements, take screenshots, etc.

I think KeePass for example uses some kind of obfuscation, but it's nothing really secure. Here's what they wrote on the official website:

Anyway, it's not perfectly secure (and unfortunately cannot be made by theory). None of the currently available keyloggers or clipboard spies can eavesdrop an obfuscated auto-type process, but it is theoretically possible to write a dedicated spy application that specializes on logging obfuscated auto-type.

I don't know when that was written, but I bet in the meantime lots of keyloggers that target this kind of obfuscation have been written, have they?

Then there's KeePassXC, which if I'm not wrong uses a totally different way of sending data to applications, without relying on simulated keystrokes or the clipboard. I don't know the details, but I wonder if that method is actually secure and if in the meantime any keyloggers that target it have been created.

So the question: are any of those auto-type methods of password managers actually effective, or is it like fighting a losing battle?

Answer 1

First of all, if you have malware in your computer, it is kind of futile to try secure anything against it, especially if it manages to get admin privileges. A process with admin privileges can read pretty much whatever it wants.

If the "key-logger" does not have privileges, there may be a way to securely type in passwords, if the browser supports it. In essence, let's say Chrome allows extensions to detect input fields and type into them. That would allow KeePass to input passwords without simulating anything and without ever going outside the Chrome process. If in addition the password is exchanged between KeePass and the extension securely (which chromelPass already does), then the passwords are safe from non-privileged key-logger.

That being said, this is kind of a perfect world scenario. First of all, I don't believe extensions can actually input data into input fields in any browser. I am not sure, but think it is possible to input and chromelPass does it. However, if you have malware in your PC, it is unlikely it would not be able to gain admin privileges.

So in a way, it is futile in theory, but in practice, most people only need to be protected against common types of key-loggers and you should always do your best not to get infected in the first place.