86

No, your data is not safe from key loggers on a local computer. There isn't much more to say here, to be fair. A key logger will grab and save any key stroke entered. The tls (https) encryption happens "after" the driver from keyboard "sends" those key strokes to the browser, "through" the key logger. Even if encryption is being used and there isn't one ...


84

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks). In the end, it is not clear that a virtual keyboard provided any ...


82

Because it wouldn't help. Most keyloggers are installed at the operating-system level, and the operating system needs to have access to the keystrokes. Alt-Tab program switching, using Ctrl-Alt-Del to terminate malfunctioning programs, and detecting keyboard activity to keep your screensaver from activating all require the OS to see keystrokes. There's ...


59

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (...


58

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen (even if ...


56

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS secure because they make it hard to use password managers. The best way to handle that kind of things is to use one-time passwords. There are several ways to ...


55

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts: Bank Web sites use passwords which are entered the traditional way, with a keyboard. Key loggers appear, and harvest key strokes. After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the ...


37

RedGrittyBrick is right. Here's how it would work: Keylogger is on host machine: even VM sessions will be keylogged. Keylogger is on virtual machine: only VM will be keylogged unless it escapes the VM. Keylogger is hardware-based: same as #1: everything can be captured, but this includes things even outside of the main operating system, as long as it's all ...


36

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall ...


32

A hardware keylogger will obviously capture anything typed on the keyboard it is attached to. So that includes keystrokes that are forwarded to a VM. I would expect a software keylogger running on the host system should also capture anything typed on the local keyboard before it gets to any VM A software keylogger running in a VM would capture keystrokes ...


31

The keyboard to application interface goes through several phases, some of which the OS has little control, and some that is provides explicit hooks into for additional functionality. The basic design goes like this: hardware events are received by driver chains, which then pass messages to the kernel, that then dispatches it to a global hotkey chain, and ...


27

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


27

The answer that you don't really want is that keyloggers can be very stealthily incorporated into pretty much anything: Keyboard with integrated keylogger: https://www.paraben-sticks.com/keyboard-keylogger.html Less savoury keylogger found in retail keyboard, sending keystrokes back: https://thehackernews.com/2017/11/mantistek-keyboard-keylogger.html Wifi ...


24

The reason this isn't done by default is because the previous-generation operating system design didn't have a huge focus on sandboxing and the like, so right now it would require big architectural changes to make such changes work. Mark touches upon those to some extent in his answer, but it boils down to that you can't allow applications to blindly run ...


24

HTTPS can't possibly fully protect your user input on an untrusted computer: The computer could have keylogger software installed. The keyboard could have firmware programmed to keylog you. There could be a hardware device between the computer and the keyboard recording keypresses. There could be screen recording software running. There could be a video ...


20

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros: they protect the password from naive keyloggers they prevent the user from storing the password in a file But they do have cons: specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation) then prevent usage of ...


19

Create GMail account with no 2 step authorization (not from friend' laptop). Log in with you friend' laptop into GMail web interface (type username/pass manually). Create new mail with subj some reports from %companyname%, attach some dummy .docs and .pdfs, type "dave123@another-company-in-your-field.com" in "To:" field. Click "Send". Enable 2 step ...


16

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a keystroke logger on the system it is very likely (apart from physical keystroke loggers) that they have privileged access to the system in question and as such ...


15

Such protection mechanism you're describing could possibly be exploited by the IE mouse tracking flaw, an Internet Explorer vulnerability that allows an attacker to track your mouse cursor anywhere on the screen, even if the browser is not being actively used, and to me seems such password protection would be more at risk of being compromised than your ...


15

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


15

TL,DR: Don't be worried, you are probably safe. Usually malware cannot escape the VM onto the host OS. There are exceptions, as some malware are designed specifically to break from the VM into the host, but those are very, very few and usually are seen on targeted attacks, not on a public internet site. Cross-OS malware infection are even rarer. Malware ...


14

You can't ever be safe on hardware you don't control. A hardware keylogger could be mounted inside the chassis where you could not see it, or remove it. A software keylogger may not be detectable by any app that you could run (if you had enough user privileges to run any app). Network monitoring and sniffing of your web traffic would be completely ...


12

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...


12

In regards to your specific question, which is safer technically depends on the site and how they implemented their security. That said, the credit card is a safer bet from a recovery standpoint. If your banking details are compromised, the attacker can drain your entire checking account, and there's very little recourse to get that money back. However, if ...


11

From 10 Immutable Laws of Security... Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore If a "keylogger" of any form is running on your computer, then this has probably already happened. The bad guy's program can pretty well do anything he's designed it to do. If this has happened to you, it's time ...


11

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story. You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn'...


10

Since you are a customer of the company it might give you some more options. A few things worth considering: Write a letter to the CEO of the company. Make a copy of the letter and send it to the person you spoke with as well as their manager. Notify the press if you think you can find anyone who would be interested in the story. File a complaint with ...


10

Using a laptop effectively prevents this. You could glue the keyboard into the USB socket. Not ideal, but hey :-) Another is to use a Bluetooth keyboard, with integrated Bluetooth on the computer. But these are all kludges really; in general I agree with the other comments that if an attacker has physical access, most bets are off. This is quite a good ...


10

Valid concern for both Android and iOS now that Apple has enabled third-party keyboard options there. For Android, there are several security solutions with firewalls that enable you to cut off network access to particular applications, even if full network access is allowed in the permissions of those apps. Some require root access and I cannot personally ...


10

Regular USB key loggers that exfiltrate their data via Bluetooth or WiFi can easily be hidden inside a keyboard. The Bluetooth loggers require the attacker to come into range to dump their contents, but a WiFi based adapter that's pre-configured with a network key doesn't even require the attacker to be present to win. He can plug it in and let it sit ...


Only top voted, non community-wiki answers of a minimum length are eligible