That shouldn't be a problem with the above program as the password seems to be covered by the asterisks.

Darrenh

One thing I heard about modern keyloggers is that they have the capacity to take screenshots on every mouse click.

TehNomad

@spiderman1369: Yeah, I've heard those iPhone addicts are a real blast to travel with...

rscotta

@Darrenh: Yeah, but if the cursor is hovering over the button of the letter, the password can still be put together. I say use the arrow keys and press the space bar to "click" the buttons.

Actually, this is a great idea, I am going to write my own program with the passwords already built in.

easy2panic

Question should be: What are you doing in a shady internet cafe in Bankok to begin with?
Isn't easier to get on the web with a PocketPC or Smartphone. I've heard of this crazy new thing called a iPhone. Don't know much about it though...!

spiderman1369

It's been a while since I've done windows programming, but this is what I remember--key presses and mouse actions are events that get passed to the application. Other programs are allowed to insert themselves in between the application and these events--this is an API call in windows (forget what the call was exactly). Since this program is just substituting the key press event for a drag and drop event, it would be trivial for a "key logger" to be updated to monitor for these types of events. I wouldn't enter any information into a public computer that I didn't consider public information--even with this utility.

cthulhu944

Keyloggers can screencapture, and you can't always use a USB in an internet cafe. So if you think you'll be traveling to bankok and will be frequenting such places, try using an online password manager, PassPack is (of course) my favorite.

* it's online, so no USB needed
* you get a disposable login, anything keyloggers capture are useless thereafter
* you get a disposable autologin bookmarklet to login to other websites with

The autologin button does not use the keyboard or pasteboard, and it does not show your passwords on screen. It's keylogger-proof. You can delete it as easily as you made it, but even if you forget - no problem, it won't work for anyone else.

Cheers! Tara

Tara-PassPack

@spiderman1369: And your iPhone works in Bangkok? Without wifi, cause the wifi is probably sniffed (unless you are using HTTPS)

ffm

I use KeePass as an encrypted database storage for my passwords. With KeePass, you can configure it so that hotkeys automatically enter username and password based on the website you're visiting. So, for example, say I'm visiting the login page of my online bank; I select ctrl+alt+p and my username and password automatically fill in.

gavman00

@TehNomad: True, it can be recorded, but at a good quality, hard drives and hard drives could be used. Keyloggers try to target people who don't use things like SafeKeys. Its the same reason why spammers don't target CAPTCHAs. Modern programs can crack them, but they try to get more things faster.

Also, couldn't you just use the Accessibility On-Screen Keyboard instead? A lot of places don't let you use USB drives... of course, they also block the start menu...

Brad

on-screen keyboards are indeed weak against screen-grabbing keyloggers and if you think the people making banking trojans and the like aren't using that technique then you're behind the times as such malware has been seen in the wild... the malware writers have been forced to adapt to a climate where on-screen keyboards are increasingly being suggested as a secure alternative password entry mechanism...

as such, the best way to avoid losing sensitive information to a keylogger remains to be to not install any in the first place... don't expect to be able to stay safe while using a compromised machine, and as for public terminals, just don't trust them at all...

kurt wismer

@kurt (as well as several others)
It's great to say "don't use public computers" when that's an option, and in an ideal situation, that's what everyone would do. Most people, however, don't spend every second of their lives in an ideal situation, so really what you have said is like "not getting into a car accident is much safer than an airbag." Yes, that's true, but you really aren't helping anyone with that comment.

Also, many people have pointed out that this will not foil a sufficiently sophisticated keylogger. This is true, but that isn't necessarily the point. Imagine that you ride a bike everywhere, and chain it up when you're not with it. Is the bike now "thief-proof"? No. But the thief is not much more likely to target a different, more stealable bike.

Tachyon0118

@Tara-PassPack: I don't trust my passwords to other parties, including online services, and especially online services marked "beta".

Another idea: use remote access to your home computer (via Remote Desktop or VNC). You can use a password manager on your home computer to avoid typing the password. The only trick is that to login to your computer you still have to type your password. So when you're logged in, make sure you change your home computer password. Nothing is fool-proof.

Posco Grubb

I have to agree with cthulhu944 that this wouldn't provide much security over key loggers. I might defeat a hardware keylogger and some really, really poorly written keyloggers but input is input no matter the method.

One tip to stay safe without any software required, is to just have several different text field open and type random stuff into each in a random order. That way the keys being logged wouldn't be in the correct order. Should defeat some keyloggers.

Mithrill

Methinks a comprehensive Lifehacker expose is called for - what's good, what's bad, what works & all the pitfalls when forced to use internet cafes & such. Particularly email, banking & dealing with photos. What say you Gina?
Yeah, I know, don't do banking - but if you're away in the boondocks for months... That KeePass with hotkey idea sounds interesting - but yeah, how common are internet cafes that allow you to connect a USB key _and_ run apps from it without admin rights?

OzTardis

If you're that paranoid (even if your paranoia is justified), just turn of your computer. Problem solved.

aaron8301

@Tachyon0118: the problem with your car analogy is that you're comparing a compromised system to an accident... change your analogy to a car that has had it's break lines cut and then at least you capture the intelligent attacker aspect of a system compromise (though obviously you have something much more life threatening)... your bike analogy, however, falls down because the sufficiently sophisticated keyloggers are not even rare (some are included in kits that can be purchased by anyone)...

i understand your main point about "don't install keyloggers in the first place" seeming non-actionable to most people, but my main point was really to not trust suspect systems with sensitive data... if it's a computer you have control over then there actually are ways to tell if an intrusion has occurred and things you can do about it... if it's a public terminal, however, there is no way - if you need to do banking then find another way (such as telephone)... any organization dealing with sufficiently valuable information should offer alternative options to access that information that are more secure than a public terminal...

and if you absolutely must use the internet for sensitive transactions but have no physical machine of your own with you that you control, i'd suggest at the very least find someplace that will let you boot a computer from a livecd and then ideally use an on-screen keyboard (to thwart possible hardware keyloggers) and an encrypted session to a remote computer you can trust (to thwart network-based shenanigans) and access the internet through that remote machine...

is that actionable enough? is that something that a sufficiently prepared person can do even when they find themselves in a non-ideal situation?

kurt wismer

@easy2panic: I don't think you really thought through your arrow-keys + space idea. How, pray tell, would someone know which key would be entered when pressing space? You'd need some type of visual indicator, and oops, now you're just as vulnerable to screen-scraping.

IMO, the problem with all of these tools is providing a false sense of security. If the system you're using is compromised, there's really not a lot you can do about it. I'm kind of disappointed that Lifehacker's advocating them without any such disclaimers. It's a bit irresponsible.

stickboy

"IMO, the problem with all of these tools is providing a false sense of security."

Exactly, there is a family of banker trojans in the wild that get around this by taking a 100x100 pixel screenshot of the screen around the mouse pointer when it is clicked. This is done to bypass these types of things that some bank websites have, but could easily be used to defeat this program as well.

BugMeNot

may I suggest [kyps.net] - this lets you log into popular websites (Google Mail, Yahoo Mail, etc) using one-time codes instead of passwords; even the most clever spyware won't have a chance...

hithere5

@Posco Grubb: No problem. Sounds like you have a different solution.

Tara-PassPack

@spiderman1369: Good point! Why Bangkok?

Lawk Salih

I guess if you could get around having the API calls intercepted, and you could handle the slowness, you could have a program like this:
- program shows all the letters of the alphabet in random order
- the letters are shown for random periods of time (say 2 to 5 seconds)
- when the letter you want is shown, you press any key when the *following* letter appears (the program understands you want the previous one).

In this way, nothing on the screen at the time you press a key indicates what key you want. Because of the random timing, you couldn't necessarily work backwards using a screenshot at regular intervals.

The keylogger would have to record fullscreen video continuously, and someone would have to go back and watch the whole thing afterwards, which is unlikely...

Oblivion

Oblivion: Even that could still be intercepted. Remember, whatever your "alternate keyboard" is doing, it's either:

1. Pasting the info into a text field, in which case it can be captured by the clipboard chain, or

2. "Typing" the info directly into that field, by inserting itself into the input chain - in which case it can be intercepted by anything farther up the input chain.

Jay Levitt

Regarding the remote computer option... Check out Logmein.com. It uses secure login and and encrypted communications, and there is an "extra security" option, which will generate (in addition to your regular password), a one-time password for each login (emailed to you, so for example have it go to your cellphone if possible), or use a pre-printed list of security codes.

zkam

Great addition, indeed. I'm looking forward to my visit to a shady cafe in Bangkok.

JamesIsIn