I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many entertainments.

Some people said that the only way to make sure it doesn't happen is by reformatting computers.

I made the question about it here How can I detect possible spyware/keyloggers in my computer?

While hacker that put keyloggers on my computers may be able to get my password, it won't be able to get my 2FA. That is as long as I generate the google 2FA on a very secure computer.

So I plan to buy a laptop. Install windows. And then install minimum programs, like malware bytes (is that even necessary). Then I would activate 2FA on that laptop.

My plan is to have that 1 laptop to ONLY be used to generate 2FA codes and change password. I don't play games there, I don't access porn there, bla bla. So the chance of getting some malware installed should be small.

What do you think? A good idea? What should I consider?

  • What about a phone? – schroeder Sep 30 '18 at 22:05
  • 1
    What about a live Linux distribution? – ThoriumBR Sep 30 '18 at 22:07
  • 1
    Reformatting removes keyloggers. It does not prevent keyloggers from being installed. – schroeder Sep 30 '18 at 22:09
  • You have used two terms as though they are the same, but they are different: 2FA keys and 2FA codes. Can you explain what you mean by these terms? – schroeder Oct 1 '18 at 6:32
  • 1
    a $20 used phone in airplane mode would be a cheaper waste of money... – dandavis Oct 2 '18 at 15:55

Using a laptop for generating "2FA codes" is per se a bad idea.

If you are talking of "2FA codes" I assume you mean HOTP or TOTP. Both rely on a symmetric shared secret (key). If you use your computer to do so, the symmetric key needs to be stored on the computer. Let us presume, it is stored in plain text. Let us simply ignore some approaches to use a weak password to encrypt the symmetric key.

Havin said this, you should consider using a dedicated hardware device to generate your one time passwords - like the yubikey or the nitrokey, where you can also install your own generated keys on. OK, you could also use an offline phone to do so.

Every device, that has complex software running and that has an internet connection is vulnerable to attacks and thus malware could steal your shared secret and thus simply create the "2FA codes" on its own.

| improve this answer | |
  • So I can require 1password to only authorize new device if I approve it from a computer with yubikey? – user4951 Oct 2 '18 at 16:32
  • It does not make sense to generate a shared secret for HOTP or TOTP within a standard hardware crypto device because you need to extract the shared secret in clear-text during enrollment anyway. This only makes sense when using asymmetric cryptographic mechanisms where you only need the public part of a key pair generated inside hardware outside of that device. – Michael Ströder Oct 7 '18 at 12:01

For TOTP, you can use a programmable hardware token . It is quite cheap (EUR19 per device) if you are protecting one account, but the downside is that it can only hold one profile at a time

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.