Best security practices in internet cafe

Question

For the next while I will find myself without a working private wifi connection. That leaves me with just a number of options, of which using an internet cafe is one of them.

What are the best security practices in an internet cafe environment, where I cannot reliably know what has or has not been installed on the computer? The internet cafe I'll be using does not let me install any software, and uses Windows XP.

I have a VPS somewhere on the other side of the globe, and the computers at the internet cafe have PuTTY installed - luckily.

I do not want to leave any traces on the internet cafe computers. Is it worthwhile to put something like TOR browser on a pen drive?

Since the cafe uses some kind of Windows app to log my time - and hence bill me - I can't really reboot from a linux pen drive without angering the owners. Can I still somehow use the relative safety from a linux OS even when not fully rebooting?

Answer 1

If you don't own the hardware you have no control. Anything you could run within that Windows environment could be logged at the keyboard and mouse input level if nothing else. If you don't trust the computer, don't use it and bring your own device. It's the only way.

Answer 2

Best practice for Internet cafes is not to use them for anything private... They are OK to check on movie schedules, maps or news, but anything which involves typing a password or access private data is really risky.

You might accept to take the risk of a malware-riddled machine which has nothing against you, personally, and just runs, say, a key logger, to harvest a lot of passwords. In that case, you could get away with using one-time passwords of some kind. There are many variants, but the whole idea is that the password, once used, is no longer valuable because it will not grant entry again.

That would still be betting on the attacker's lack of interest and/or competence. A more thorough attacker will actively recognize connections to Webmails (in particular Gmail) and automatically enact its nefarious acts right away, while you are logged in. Personally, I would not do it.

Answer 3

I see a few options:

• Update your password on each login or write a script to do it and have the script print the new pass to the screen. While a keylogger could capture your new password as you enter it, an attacker would have to be scraping the PuTTY screen to see your new password if a script updates it for you. As soon as the new pass pops up, write it down (or memorize it!) and use clear to prevent shoulder-peekers from seeing it. This is a tricksy thing to script but it can be done. On Debian-like systems you can use mkpasswd to create a hashed password then you'd just have to replace your existing one in /etc/shadow. Note: Hacking up a password reset like this is extremely dangerous.
• Change /etc/ssh/sshd-config to use key-based auth only (set PubkeyAuthentication yes and PasswordAuthentication no). You can use PuTTY to generate SSH keys (remember to use a strong passphrase!) then store your public/private key on a thumb drive. Tell PuTTY to auth with that (see https://wiki.amahi.org/index.php/Key-based_SSH_Logins_With_Putty#Configuring_putty_to_use_public.2Fprivate_keys). The key will exist in memory as long as PuTTY is open and your passphrase could be logged but an attacker would have to dig both out. Chances are one or the other will get lost in the noise.
• Get Google Authenticator for your smartphone and set up a compatible two-factor authentication system on your Linux VPS. Combine with one of the two above options. This is not a straight-forward process, see here for more info: http://www.tecmint.com/ssh-two-factor-authentication/

As everyone else has said, an internet cafe is going to be pretty insecure and not trustworthy. I think your best bet is to do everything private you need to do through the VPS and use two-factor authentication.

Also: Never use the same machine twice. Switch internet cafes daily if you can.

Answer 4

In Summary:

Use a VPS with second factor authentication if you have to use a hardware that is not yours and connect through it.