Slashdot Mirror
Hardware For Protecting Your Passwords?
AstroBush asks: "I was reading this article which raised a very interesting question: Hardware keylogging devices now exist which can record all output of the keyboard regardless of operating system, permissions, or any software-based controls. How can I protect myself from having a co-worker (or student, thief, ex-wife, etc...) using one of these devices on my machine? Is there any keyboard available which encrypts output before it reaches the computer?"
If you only ever key in the wrong password, no-one else will be able to get in either. True, it may reduce your productivity but it is more secure.
You might also want to consider using a slide-rule rather than a computer.
Use a one time pad for logging in. This way, someone may monitor one session, but that doesn't open up your machine.
Joe
Joe Batt Solid Design
if the device that intercepts it is between the keyboard and the computer, then a keyboard that sends encrypted text will still get read--of course they will not have your password, but they will just have to replay the data collected when you typed in your password!--as others have said, if they have physical access, just forget it, they have it--if nothing else, an over the shoulder camera!(remember Sneakers!)
;-}
Slackware: old school feel, new school gear.
Silly question. As another poster said, the instant they get to your hardware, just give up. Fine, let's postulate a keyboard which entirely encrypts everything, unbreakably. So the person who would otherwise just log your keystrokes instead puts a little RF transmitter under each key that triggers when the key is depressed... in effect, they've mirrored your keyboard, and now have a perfect key logger, even if your keyboard isn't plugged in. The simple fact is that there is no safety, once you allow people to fiddle with your hardware. The solution? Don't let 'em.
I've had this sig for three days.
How about plugging in a USB keyboard you carry with you? Of course, make sure it plugs directly into the back of the computer and not into a duct-taped USB hub(nothing suspicious here). Lock up the box and you are set for the physical security.
I think the answer is, "you can't". The information is unencrypted at some point, and if your adversary has physical access to your computer they can get at it. The FBI has been known to install bugs within the keyboard itself to record keystrokes in cases where the target has encrypted the data on the computer.
If you are doing something so important that someone is going to go to the time and trouble to attach a keystroke monitor to your pc, maybe you should hire some guys with guns to secure your computer.
Conformity is the jailer of freedom and enemy of growth. -JFK
copy and paste letters from words with your middle mouse button (or whatever it is in ur os).. eg, password "fruit" take an f from "firewall" r from "reply" etc.. :-)
stuff
I have an easier solution. Every time you sit down at your computer, check the keyboard cable and make sure it plugs into the computer rather than some mysterious "black box" that somebody's put there. If you think somebody's going to put one inside your keyboard, then take the keyboard with you every time you leave. Consider locking your PC case to prevent anyone from opening it to install a device in there. Like somebody already posted, if you don't have physical security for your machine, you're pretty much screwed anyway.
The answer to this for security conscious organizations is SecureID. See http://www.rsasecurity.com/ for more info.
--
$ chown -R us:us yourbase
That, or it's not very funny.
Anyway, the answer is no. If they can tamper with your hardware, you're throughly screwed.
Time Password system. You can either generate a list of passwords and carry them around in your pocket or run a password-generating utility on a PDA. If someone snags one of those "disposable" passwords, it will do them no good.
2. Don't use passwords; switch to public keys and store your private keys on a smart card or iButton (which someone else already mentioned).
My browser munged the first part of my post. It should have said:
1. Use a One Time Password system.
For any keyboard system to be encrypted, you would need both hardware and either firmware or software support for it. Given the power of the CPUs put into keyboards, I don't think you would find strong enough encryption to be useful. After all, with a keyboard it's dead simple for a perp to run a known-plaintext attack on the keyboard.
Consider a laptop that you keep in your possession at all times, or lock in a safe when not in use.
Physical security is all-important with keyboards.
(And I hope this wasn't the last of the April Fool's Jokes -- they got old real fast this year.)