When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply refusing the access to all applications that are not on a whitelist? And the problem is how to manage the whitelist ...

  • 1
    An application or an operating system? As I understand it, macOS does what you are describing. Commented May 2, 2019 at 17:55
  • @AlexanderO'Mara i thought the same thing.Maybe he means like an antivirus application
    – yeah_well
    Commented May 2, 2019 at 20:19

1 Answer 1


And the problem is how to manage the whitelist.

And that problem makes your solution impossible. Let's see why.

Debuggers and other developer tools

They can access low-level functions like those used by keyloggers, but are used for legitimate reasons by developers. If you whitelist those, developers are in risk. If you not, they productivity will be impacted.

Angry developers are bad for the health of the company.

Dynamic Link Libraries

Also know as .dll (or .so on Linux). If a trusted application can load an external library file, this file can be hijacked and execute malicious code inside the application memory space. Now you have to whitelist library files too. But those files receive upgrades, so you must create a whitelist of every single version of every single library file for every single application you have.

A difficult job to create, an even out-worldly nightmarish difficult job to maintain.

Malicious use of manufacturer applications

If you allow drivers signed by certified manufacturers and an attacker gets the certificate private key (that happened more than once), they can put any application on the whitelist. Once that happens, or you remove the entire certificate from your whitelist (and break every system that have those legitimate applications running) or you leave it active and risk infection.

You create collateral damage. Users not likely to be affected by the keylogger are affected by your blacklist.

Hardware keyloggers

This is outside of your scope, but even with a really tight closed security, a hardware based keylogger is impossible to detect by software, cannot be protected against.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .