Skip to main content
85 votes
Accepted

Is the data between a keyboard and a web browser secure from local computer applications?

No, your data is not safe from key loggers on a local computer. There isn't much more to say here, to be fair. A key logger will grab and save any key stroke entered. The tls (https) encryption ...
bashCypher's user avatar
  • 1,885
82 votes
Accepted

Are virtual keyboards not necessary anymore to protect against keyloggers?

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new ...
schroeder's user avatar
  • 131k
59 votes

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can ...
Steffen Ullrich's user avatar
56 votes
Accepted

Keylogger web application protection

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS ...
Stephane's user avatar
  • 18.7k
36 votes
Accepted

Why is it considered safe to install something as a non-root user in Linux environments?

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: ...
Mike Ounsworth's user avatar
27 votes
Accepted

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the ...
O'Niel's user avatar
  • 2,914
26 votes
Accepted

Can keylogger software exist solely on a keyboard PCB?

The answer that you don't really want is that keyloggers can be very stealthily incorporated into pretty much anything: Keyboard with integrated keylogger: https://www.paraben-sticks.com/keyboard-...
Jozef Woods's user avatar
  • 1,237
23 votes

Is the data between a keyboard and a web browser secure from local computer applications?

HTTPS can't possibly fully protect your user input on an untrusted computer: The computer could have keylogger software installed. The keyboard could have firmware programmed to keylog you. There ...
Macil's user avatar
  • 1,500
20 votes

Are virtual keyboards not necessary anymore to protect against keyloggers?

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros: they protect the password from naive keyloggers they prevent the user from storing the password in a ...
Serge Ballesta's user avatar
16 votes

Keylogger web application protection

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a ...
Rory McCune's user avatar
  • 62.4k
15 votes

Can a website keylog you outside a virtual machine

TL,DR: Don't be worried, you are probably safe. Usually malware cannot escape the VM onto the host OS. There are exceptions, as some malware are designed specifically to break from the VM into the ...
ThoriumBR's user avatar
  • 54.5k
11 votes

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that ...
Evan Steinbrenner's user avatar
10 votes
Accepted

How to detect a keylogger in a USB keyboard? Can a USB keyboard host a keylogger?

Regular USB key loggers that exfiltrate their data via Bluetooth or WiFi can easily be hidden inside a keyboard. The Bluetooth loggers require the attacker to come into range to dump their contents, ...
John Deters's user avatar
  • 34.2k
9 votes

Why is it considered safe to install something as a non-root user in Linux environments?

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has ...
Robert Mennell's user avatar
8 votes

How secure is "Secure Keyboard Entry" in Mac OS X's Terminal?

There's somethig else worth keeping in mind—and, it appears to me, not widely appreciated: On POSIX systems, any terminal has its own 'teletype' device. And every process you run can read from that ...
Odin Kroeger's user avatar
8 votes
Accepted

Does the use of an on-screen keyboard give a false sense of security or protect against all types of keyloggers?

Yes, it is most often just a useless "security measure". We need to define the threat model and then if an on screen keyboard provides a proper mitigation. A OSK will protect against two threats: A ...
Ángel's user avatar
  • 18.9k
8 votes
Accepted

Is it possible to trick a keylogger, when entering a password?

Its impossible to tell without knowing which exact keylogger. Depending on how the keylogger gets the keys, it can be tricked. For example, if the keylogger works on such a low level that it gets the ...
Out of Band's user avatar
  • 9,283
8 votes

Where does Windows 10 save Keyboard input?

There is a lot of hyperbole in tech journalism, just as there is in other journalism. While Windows 10 does indeed collect a lot of data about you, some of it being the result of key strokes, it does ...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Does karabiner elements on Mac OSX contain, or potentially contain, malware?

I am not sure anyone here would be willing to read through it but my advice would be: Read through the bug reports Research information on it and read as many reviews as you can. It has a lot of ...
TheHidden's user avatar
  • 4,345
7 votes

GUI isolation in X11 when entering Truecrypt password

Xterm does not allow isolation unless you set it to run as another user, in another tty. Gksu and Gksudo do not provide any sort of isolation at all. The same applies to all other password entry ...
forest's user avatar
  • 66.9k
6 votes

Keylogger web application protection

JavaScript cannot control low system calls and change them to get that keystroke interference. Even user-mode software protections are defeated by kernel-mode keylogging. You can protect against ...
Cristian Dobre's user avatar
6 votes

Is LastPass' Formfill inherently compromised?

Aren't you kind of already at a worst case scenario level with security when there is a keylogger installed? It would be very dangerous to assume that LastPass (or any program) can protect ...
le3th4x0rbot's user avatar
  • 3,249
6 votes

Is it possible to login on an machine with keylogger installed without compromising your password?

Go on your phone and change your password to a random one Login on the compromised PC using the random password On your phone change the random password back to your normal one
paj28's user avatar
  • 33.5k
6 votes

Generating a secret on a compromised computer

If the machine is compromised - there is nothing that you can introduce to make it harder to capture - they own the box, the memory and the OS. From what little I understand of Ruby as well the ...
McMatty's user avatar
  • 3,250
6 votes

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

Ultimately ... It wouldn't matter at best this key substitution would equiv to a Caesar cipher ... which can be easily broken. Qwerty The quick brown fox jumped over the lazy dog Dvorak Yd. '...
CaffeineAddiction's user avatar
6 votes
Accepted

How to analyze malware to find out where keylogger sent data?

If you are not an expert in this skill, there are still some automated malware analysis tools that you can use to get some information from the files. Sandboxes can be a very useful tool, and Cuckoo ...
schroeder's user avatar
  • 131k
5 votes

Why is it considered safe to install something as a non-root user in Linux environments?

The system itself is safe from accounts that aren't root-equivalent, but that doesn't help much on a desktop where most of what you care about is your own data, and you authenticate regularly to ...
Peter Cordes's user avatar
5 votes

Keylogging over the internet

Key loggers can be inserted on to a system via a wide range of attack vectors. Not all are reliant on physical access - although some are. Keyloggers are generally broken down into two main ...
R. Murray's user avatar
  • 754
5 votes

How to detect a keylogger in a USB keyboard? Can a USB keyboard host a keylogger?

I'm reading the question and seeing "could the keyboard" and what comes to mind is that most keyboards I've cracked open have an Atmel32u[4,8,X] controller, these controllers are running a firmware ...
Ori's user avatar
  • 2,777
5 votes
Accepted

What steps should I take now that my online gaming account was compromised?

Not every case of fraud is the result of some crazy nation-state sponsored rootkit worming its way through your network. First, consider the target. It's an online gaming account, existing ...
Ivan's user avatar
  • 6,328

Only top scored, non community-wiki answers of a minimum length are eligible