Sometimes i need to use a public pc to access my gmail account, is there a safe way to login and keep my password safe in case there was a keylogger or a trojan on that pc? are there tools that could help in that case?
Enable two factor authentication. Consider the remembered password compromised to any user of the public computer.
EDIT: My answer dealt with how to prevent your password from being keylogged. With two-factor authentication your password is now the combination of a randomly generated one-time use code (obtained via cell phone or pre-obtained list) as well as the remembered password; hence a keylogger doesn't give an attacker the ability to log in as you for a future attack.
However, I definitely agree with TomLeek and Nic that in a real-time attack (not a keylogger looked at after the fact) that captures your random session token (that indicates to gmail you are signed in before you do any action), an attacker can fully use your gmail account (send emails as you; search through emails sent to you; delete your emails; etc). Granted, once you logout your session token will become invalidated and will kick them out of your account. Granted a clever attacker could write a browser plugin to collect your session tokens, send it to them, and then redirect the logout page to not actually invalidate your token. Though you could always login to gmail again, view the link for "Last account activity [Details]" and sign everyone else out.
I access my gmail from my phone, but occasionally need to get to an email from a public computer. An example would be printing tickets from a hotel business center.
I keep a separate gmail "dropbox" account for this purpose... I just forward the relevant email using my phone to my "dropbox" email account and then access that account from a public computer.
- email@example.com = my real gmail acount
- firstname.lastname@example.org = my gmail dropbox account
I don't fret about exposing the password for my dropbox email account since its almost always empty.
... But I still use google's 2-factor authentication for my main account.
Stricto sensu, the only way to keep your private data private while accessing it on a potentially compromised public PC is to pray. If the PC is indeed compromised, then the villain who controls it now knows everything you typed and saw and downloaded and uploaded through that PC, and that includes, of course, your password. You will be safe only if the attacker, through laziness or incompetence, elects not to bother with your account. Gmail's two-step verification, which dr jimbob mentions, will somehow contain the damage in that the stolen password will not be sufficient to easily connect again on Gmail; but for the duration of your session, your Gmail account was nonetheless a free-for-all fair.
Also, if you can use Gmail's two-step verification, then you have a phone -- make that a smartphone and you will be able to access your emails from the phone alone, totally bypassing the PC of dubious cleanliness.
Logging into email (or any other service) from a public PC is risky. Of course you need to use strong authentication. But also, you need to consider whether the host is a trustworthy actor. When you authenticate yourself, you are effectively delegating access to the host you're using. Consider these attacks made possible on an untrusted host.
- The list of trusted certificate authorities could be modified to allow man-in-the-middle attacks against common websites like gmail.com.
- Malware in the browser could intercept your browsing and perform extra actions on your behalf, such as creating mail rules and/or exfiltrating mail messages.
So what can you do about a public PC that can't be trusted? You need to decide which parts of the system you can trust. You can probably trust the CPU and memory in a public PC as much as you can trust your own personal computer. But the operating system and browser are much easier to attack, so you trust them less. Here are some ways to mitigate the common risks.
- Install Portable Firefox on a USB drive so you know that the list of certificate authorities has not been tampered with. (Bonus points if the USB drive can be made read-only with a hardware switch).
- Bring your own bootable CD-ROM or USB drive with something like a Linux LiveCD or Windows To Go.
And for bonus points, here are some things that developers can do to improve application security.
- Allow users to generate single-use passwords for limited access to the service. For example, this could be used for read-only access, or time-limited duration. Basically, use alternate authentication that applies more strict access controls.
- Force users to re-authenticate for privileged actions. (Gmail already does this for some actions.)
There are some inherent risks to consider, even if you can use a one-time password. Google Accounts is big and important, so there's a risk that Google may be targeted specifically.
I expect that a compromised system could change your GMail settings to forward a copy of every mail you receive from then on. (As well as reading all your old email while you're logged in there). It would then be able to gain access to other accounts e.g. facebook (I think), or a blog account. By using the "forgot my password" feature to request the other account to send a new password to the registered email address. Which the attacker could then read.
I expect they could even change your GMail settings to define a filter, which deletes the "here is your new password" emails after they've been forwarded, so you wouldn't notice those emails. (You would only notice when you tried to log in to the other account, your original password didn't work, and you're not able to use the "forgot my password" feature because the "here is your new password" emails are still being filtered).
The "forgot my password" attack is probably not a huge issue. It's probably going to be spamming, like the facebook/yahoo account hacks that happen, and the pain is more from having to clean up the mess, rather than any significant harm.
Google might mitigate this as well. E.g. for the more stealthy variant: If a user changes their forwarding settings while logged in from a new computer/browser (or perhaps even an old one), then the next login on each other computer/browser(s) could tell the user about the forwarding changes.
If you turn on the 2-step authentication you can use a backup code, which is basically a one time use password.
If you are using public wifi you may consider VPN like Anonymizer. Refer to this link for more information: http://arstechnica.com/security/2011/01/stay-safe-at-a-public-wi-fi-hotspot/
My solution to this problem at university where the computers were constantly becoming infected with flash driver viruses and trojans. Was not to use the installed system. When you have put hundreds of hours into your projects you can't take a chance the the computer you are connecting to is just going to corrupt and destroy all that work.
I would carry a boot able live cd / or usb drive of one of the thousands of Linux operating systems. I would boot into a working Linux operating system and do what ever I need to do with out mounting / using the infected / compromised internal hard drive. This limited my exposure to the malware that could potential be found on the internal disks.
You may need to ask for permission to do this at a internet cafe, or library. It should not be that difficult to do. Most live disks give you a web browser, Libra of Open office for reading an writing most office documents. On bootable usb drives you can install software and have it there the next time you boot up.
One of the only post configuration issues I had at university was setting up the network connectivity so I could browse the internet. The university had set up a proxy server that all the computers used to access the internet. You will need to find which of these settings apply to the public computer systems you are trying to access. It would probably be helpful if you use the same public computers systems over and over to save these types of settings in text file on a flash drive that you carry with you. Bootable flash drives give you some control over which settings you want to save to your disk. I currently use the ubuntu 12.04 lts bootable usb drive.
- Use Chrome Incognito Window
- or Firefox Private Browsing
- or god forbid you need to use IE InPrivate Browsing
- or Safari Private Browsing Make your own shortcut