Sometimes it happens that I have to access my email or some other web service from public machines. Are there any options to make it secure or at least reduce risks to acceptable levels? I am most worried about keyloggers. But even if can copy-paste password from somewhere there are still tools to intercept that. So there is basically no security by definition? One measure I can think about is two factor authentication, but it is not always available (for every service). Other possible measure is to have a server/machine somewhere and access it using some sort of remote access, but this requires considerable resources.
The usual recommendations about accessing private data from a public computer are:
- Don't do it.
- Don't do it; instead, use a smartphone or tablet.
If your really must do it, there is no other choice, it would be life-threatening not to read your email, then the following mitigations can be used:
- Use two-factor authentication (e.g. with Gmail), the second factor using your phone (presumed safe).
- Use One-Time Passwords.
- Change your password from a "safe" computer as soon as possible after the access.
The first two mitigations suppose that you can enable these extra authentication methods on your Webmail, and that you have some extra device with you (a phone to send or receive a password by SMS, a generator for one-time passwords, a printed list of your next 20 one-time passwords...). The third mitigation depends on how soon you may access a safe computer, but, of course, if you can use a safe computer within the next five minutes, then why don't read your emails from that safe computer ?
In any case, whatever you do, you are betting that possible attackers won't hijack your connections automatically; instead, that the attackers passively gather passwords and won't do anything else immediately, leaving you with some minutes or hours to "plug holes". There are some attackers who act that way; but there also are other attackers who recognize connections to various Webmail systems and automatically hijack them. So, really, don't do it.
You could boot the workstation using a live distro or an OS installed on a USB key such as Ubuntu. But be sure there is no hardware keylogger and when you send sensitive information over the network be sure to use encryption using a trusted certificate.
- Install the PortableApps edition of Firefox to a USB thumb drive. This ensures you are using the latest version of Firefox. I am assuming the public computer you are using is running Windows.
- Whichever online email service you are using, e.g. Gmail, turn on two factor authentication. Gmail now lets you use a smartphone app called Google Authenticator to generate a token, in a similar way to an RSA keyfob. This is used whenever accessing your email from a new (previously unseen) computer.
Use one time passwords. This requires you to be working on a service that supports one time passwords - I don't know of any, but I don't see any logical reason they could not.