Slashdot Mirror
Best Way To Avoid Keyloggers On Public Terminals?
goombah99 writes "While on vacation, I occasionally need to check my e-mail on a public terminal. What are some good techniques for avoiding keyloggers? Most of my ideas seem to have major drawbacks. Linux LiveCD can probably avoid software keyloggers, but it requires an invasive takeover of the public terminal, and is generally not possible. Kyps.net offers a free reverse proxy that will decode your password from a one-time pad you carry around, then enter it remotely. But, of course, you are giving them your passwords when you do this. You can run Firefox off a USB stick with various plugins (e.g. RoboForm) that will automatically fill the page in some manner they claim to be invulnerable to keyloggers. If that's true, (and I can't evaluate its security) it's getting close to a solution. Unfortunately, keeping the password file up-to-date is a mild nuisance. Moreover, since it will need to be a Windows executable, it's not possible for people without a Windows machine available to fill in their passwords ahead of time. For my business, I have SecureID, which makes one-time passwords. It's a good solution for businesses, but not for personal accounts on things like Gmail, etc. So, what solutions do you use, or how do you mitigate the defects of the above processes? In particular, how do people with Mac or Linux home computers deal with this?"
I click around on icons until I can copy and paste a lot of letters into a single file. Then, with my Alpha-pallette, I cut and paste each letter as needed.
Umm -- simple answer, don't access trusted information from an untrusted terminal? You can have no expectation of privacy while using that machine.
Copy and paste your password from random letters around the page. Unless they log everything that goes into the clipboard they can't tell what you put in. You can also copy/paste extra letters and paste over them for added security if you're really paranoid (or they log the clipboard).
A bullet may have your name on it but splash damage is addressed "To whom it may concern."
You could type the letters out-of-order, then rearrange them using drag+drop. Someone with a keylogger probably wouldn't bother using the mouse input to figure it out.
I'm not trolling here. If you're being keylogged, then even if your password isn't stolen, every single thing you do on that computer must be treated as public. Emails would be keylogged too.
Once you suspect a terminal is owned, that's it, game over, don't trust it. Probably not what you want to hear, and definitely not convenient for you, but every other solution is a compromise in security.
The ONLY alternative I could think of that I can stomach is to have a separate email address that you use only from public terminals. Change the password often and consider anything you say via that account to be as public as if it were announced over a PA system at an airport.
These posts express my own personal views, not those of my employer
Any smart keylogger will look at the raw text behind any password field on a website. Cut and Paste etc would be useless.
Enter your password in a different order than it is spelled? Simplest example: given your pass is "password", first write "pasrd", click between 3rd and 4th asterisk, complete it by entering "swo". The more complicated, the better.
I'm using this when I absolutelly need to use web cafe/etc....should fool most keyloggers, I guess. I still change my password afterwards as soon as possible.
One that hath name thou can not otter
I used a temporary account for email while on vacation. Stolen? No big deal. Throw away when done.
To get root access on my server, I use a one time password system(rfc 2289). I use a S/KEY calculator on a palm pilot, and PAM Opie on the server. The public terminal never sees a long term password, it never leaves the PDA.
Not much else to be said. Maybe you could also use a crypto token and asymetric crypto, but considering that you need drivers, I'd say it's not practical. You might still use some sort of somewhat disposable private/public key. That should defeat keyloggers, but you risk getting your key compromised (that's why it's disposable).
GPG 0x1B479C78
When it comes to security, the best answer usually becomes the most unpopular and hard to swallow.
--- Grow a pair, liberals... stop letting the Republicans bully you!
What protection does that afford against a physical keylogger?
Not all keyloggers are software.
If I have nothing to hide, don't search me
Just always run Firefox off of the stick (even while you're at home). Otherwise, the only thing I can suggest to you is to pull up the virtual keyboard and input using the mouse; you'd have to move the window around after every few characters to try to fend off programs that track mouse movements also. If the machines Tempest-ed (or its local equivalent) or the screen is being recorded, you're out of luck anyways. If it's not your machine, you really can't do anything about this sort of thing.
One-time passwords are the best, since they require a man-in-the-middle ralt-time attack to be broken. This is very unlikely on a public terminal. As to implementation, carrying around a printout is propbably enough for the avaliable remote-login solutions for Unix.
For Web-Stuff, and other servers you do not control, you are screwed, unless you can reboot the machine with your own system. There is basically no way around a keylogger without that. If the attacker invests a bit more, thay can also directly listen to the keyboard via hardware-device.
The best option is still to have your own reasonably secure device (PDA, Laptop or the like) and use wireless Internet. With the eee PC this just got a lot more affordable.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
He uses only the mouse, so it is invulnerable to that method, actually. You need to capture the mouse actions and the screen simultaneously. This is something not easily done in separate hardware.
Setup a Knoppix or other (Ubuntu?) livecd using the available tools. Don't worry about anything except setting up an IPSEC tunnel, with preset keys to a machine at home. Presumably this machine should be pulling down your email and other data that you need to access. Since the boot is fresh from a trusted CD it defeats software keyloggers, and using the secure keys also sets it up so you don't have to worry about hardware keyloggers getting your passwords.
Frankly, you ARE better off with some form of wireless PDA or PDA Phone... but if you want to be cheap, it will still cost you time.
" What luck for rulers that men do not think" - Adolf Hitler
So, thinking about this a bit...the point is you need a password that can't be used later. The digital services are fine, but do we really need more than a 1-5 minute resolution here?
So a clever IT department could make passwords dependant on the time and date. Print out a code sheet, different for each employee, with words substituted for the date and time, a short word for the date and a short word for the ten minute time period you're in, something like that.
This way the password would be useless to a logger, you'd need a code sheet to log in, but it doesn't seem like it would be THAT much trouble (if your info is so important you're this paranoid...)...
I call the patent!
...then don't use a public terminal.
I'm really not being flippant here. The posters above have listed some ways around a basic keylogger, but there are other ways a system can be compromised. You could be dealing with a program that takes screenshots and/or reads the clipboard at random intervals. Hell, there could be a program on there that silently redirects you to bogus lookalike sites that steal your info. Not that this is likely, but it's possible.
My policy on using public access computers is that I only use them when I have no other choice, and the more valuable the data I need to protect, the less likely I am to use one.
There are so many more attack vectors than a keylogger that, if I were you, I wouldn't just focus on that one thing. If your data really needs to be secure and accessed remotely, get yourself a laptop and a data card from one of the cell carriers. At least that way, you can keep physical control over your machine and avoid the risks of using a hotspot. Of course, if you think that someone will be able to tap into your wireless connection through a cell phone carrier, than you likely have more issues than we can address here.
A LiveCD will not save you from a hardware based key logger
You could try running Portable Firefox with KeyScrambler from a thumb drive. https://addons.mozilla.org/en-US/firefox/addon/3383
If you've got to stay in touch on the road then take your own machine along - either a laptop or a portable device like an iPhone. You can find wireless access almost anywhere and while that wireless may be hacked, at least the machine you're using won't be.
The suggestions to use a Linux CD or Firefox from a USB memory stick aren't going to give you the safety you're looking for. Even if you boot from a CD, the system will still read the MBR from every drive connected to the system when it boots. If that MBR is "adjusted" then that machine is compromised no matter what you do.
Remember: do NOT enter any information into a public terminal that you wouldn't want to publish in the newspaper.
I once had to remote support a customer in another country and they sent us a little card-sized gadget that displayed a random code that changed every few minutes. It was synchronised (by the clock being pretty accurate I suppose, or possibly by radio signal) to an identical random code list at their site. So whenever we wanted to log in we just looked at the current code on the card, typed it in and at their end the code was checked against the current code.
This sort of set-up could be very useful for people who frequently use public terminals. Your code can still be compromised but the crooks would only have a few minutes to retrieve and use it. Maybe you could even have it so that when you use a code once, the central code verification server invalidates it, so no-one else can log in, even if they do get the code quickly.
I don't believe anything like this exists for the average person wanting to use normal email accounts though. Anyway, none of this changes the possibility that there are screenshots being taken every few seconds so that all of your private emails will be viewed later anyway.
Certain sectors of the defense industry, for one. Mostly it stems from fear of camera phones, so they ban all phones from the facility period, camera or not. But there are also other concerns that they have, rightly or not.
Touch everywhere, even when inappropriate.
I built a system in the late 90's where you had a web-page where you entered an account-name. That name was tied to a cellphone number which was sent a generated password as a text-message. The password was only valid for 5 minutes.
AFAIK it's still in use and have never been cracked.
--- Reality doesn't care about your opinions, it happens anyway and if you are in the way you'll get squished.
What kind of place doesn't allow phones and also has publicly available computers to use?
...I carry my own means to do so. Wether that be a smartphone, iPod touch, PSP, laptop with wifi, wireless broadband or (a consideration when I am travelling in developing nations) a satellite modem...
IMO, the use of a public terminal for private purposes is the height of stupidity.
This would require server-side scripting, but what if each account kept a phone number on file? If the person uses the correct password, keep them out but text message them a single-use password. They can now log-in with the single-use password.
Now the system requires something you know (your password) and something you have (your phone).
The ______ Agenda
He's getting rather old, but he's a good mouse.
I bring it with me - I have a macbookPro and I don't use public terminals. You can get cooties that way.
RS
Shoes for Industry. Shoes for the Dead.
Having set up several, and helped a company to standardize their installation of many, I gotta tell you that with rare exceptions* in-room internet access is the most dangerous network imagineable.
The "lowest bidder" effect will apply all through the chain of decisions with the end result of that little wire (or wifi) linking you to every possible attack vector known to man. Even in the hotels with firewalls (mostly to save address-space costs with the ISP, not for your safety) the inside will almost always feature some knucklehead with something on their laptop.
And all the above refers to the innocent sources. The malicious types, well, they have free reign for the most part.
For What It's Worth.
*the exceptions would be those hotels that employ some rudiments of network security, usually segregating sections of the hotel. Only one that I know of had per-room VLANs, which was certainly a good start.
OpenID was mainly done to protect user's credential and to implement a global Single Sign-On process. VeriSign is an OpenID provider (https://pip.verisignlabs.com/), and they provide increased security by adding a two-factor sign-on (https://idprotect.verisign.com/learnmore.v). This way if someone get your long-term password on the VeriSign website, your account is still secured by the single-use key generated by the device.
Identity Theft International bans phones but offers free internet access in most cities. Don't worry about that funny message about site certificates not matching, it's just our https proxy. Click OK! Click OK!
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
I actually have flash disabled in all my browsers, mostly because I can only use a fraction of my pipe for surfing.
All the sites I patronize have, thus far, operated perfectly fine without flash. Once they begin to demand flash or other such crap, I'll find alternatives or do without. Flash has FAR too much risk of being abused (and has been) in the past. Same with javascript and especially Java. I surf for information, not flashy buttons and popups.
Speaking of funny, I checked out "classmates.com" recently, and I must say DEAR GOD... (my personal profile is full of bullshit per my specification) ye gods those people have put up everything but their online banking password on those entries. But that isn't the worst part. The worst part is loading that website, and receiving twenty different batches of advertising tracking cookies, three batches of tracking cookies from the site, and watching it load and move around slower than mollases.
Is that truly necessary? Hell, they charge these people for memberships. I actually test drove a membership some years back just to see, and even then, even for "paying members" they still didn't remove the adverts and other sluggish bloat on their site.
I restate my question. Is that kind of bloat TRULY necessary?
" What luck for rulers that men do not think" - Adolf Hitler
Which does you what good, exactly, when malicious software already has control of the OS and can see (and alter) everything that passes through memory?
I'm aghast at all the people suggesting nonsense like copying and pasting or making silly efforts to run trusted copies of applications. If the OS is compromised, absolutely nothing you can do at higher layers that will not be compromised.
As (terrifyingly few) people have already said, the answer to the original question is that you can't. If the machine itself is untrusted, any attempts to add security atop that is just building castles on quicksand.
If I'm staying in a hotel at nights, then I'm bringing my own laptop and thus, STILL don't need to use a public terminal.
Modding Trolls +1 inciteful since 1999
Windows xp Start>Accessories>Accessibility>on screen keyboard. i typed this on it.... do key loggers record clicks or screen shots cause I really dont know?
Setup VNC or something similar on your home desktop. Create a list of passwords you'll use for the duration of your trip.
Every time you stop by at a cybercafe, connect to your VNC, do your business with all your passwords pre-saved safely on your home desktop. Once done, execute a script which will change the password to the next password on the list, log out, and move on.
I haven't done this myself, but last time I went to Italy and had to use some really shady cybercafes, I really wished I had a system like this in place...
- shazow
Quite a lot of internet terminals in airports and around the place now use a network booted OS image. As soon as a user is finished and logs out, the system reboots and boots up off a read-only image on the network.
Stick to these types of internet cafes and there's less risk, as users aren't able to fiddle with the OS.
They are usually run by larger companies or are part of a franchise as well, and often coin operated, therefore don't have a flow of short-term staff coming through.
Also if the computer has a regular keyboard on a cable (not bolted into the desk) check the cable for hardware key logging devices...
http://images.google.com/images?hl=en&q=ps2+keylogger&btnG=Search+Images&gbv=2
Sometimes the smaller internet cafes and youth hostels simply just have unsecured windows boxes, pretty dodgy. I remember a couple of years back I was in a hostel in Madrid and was using the computer to book my next hostel in the next city I was traveling too. I put the first digit of my visa card in (they all start with 4) and the form auto-complete feature displayed every visa card that had been entered in the past. As Garth would say "that's not good, i'm not happy". I didn't book obviously.
Time zone converter
>Is that truly necessary?
The LAST thing I want is contact with anybody from my High School.
So
-fb Everything not expressly forbidden is now mandatory.
...and nobody ever thought that the batteries could be sneaked in? Hell, some (if not all) phones can work powered by USB connection alone.
Did you know that "FTW" ("for the win") is a direct translation of "Sieg Heil"?
Many areas are accurately classified as "secure." Rent-a-cop manning a checkpoint at a facility surrounded by a scalable fence? Secure. Unguarded arms room? Secure. Building with armed guards, roving K9 patrols, and access controlled by multifactor authentication? (Probably) secure. The restrictions in effect depend on the nature of what is being safeguarded; comparing two situations is like apples and oranges. What I can tell you is how data/equipment of different classifications are treated.
FOUO/Unclassified-Pretty much the catch-all for government owned IT-equipment. Could have just a OEM copy of WinXP (standalone systems), or our enterprise's standard image. IT BBP applies: no end-user admin rights, but no restrictions on networking, only "approved" hardware/software. If lost/stolen/compromised, investigation is launched to determine possible risk (in aggregate, even unclassified data can yield vital information on operations) as well as verify that data was in fact only FOUO. Standard WPA/WPA2 is not considered acceptable for work-related activities, but there are approved solutions for official wireless use out there (AirFortress being the most popular).
Sensitive but Unclassified(SBU)-generally anything with SSNs or personnel data warrants this classification. Not approved for travel/remote use unless there's encryption in place. Aside from that, same as FOUO.
Confidential-Never encountered it applied to data. Should never be on a Unclassified system.
Secret-Computers, CDs/floppies, printers/copiers: everything Secret must be accounted for. Efforts are made to ensure only Secret devices touch the secret network (for me, SIPR). Secret devices are secured when not in use (otherwise they're hand-carried; oh yes, I was a COMSEC courier), and should never touch unclassified networks. Treated very similar to individually-issued firearms: nobody carries a device home for the night. Wireless is definitely out of the question.
I don't have experience with anything higher than Secret.
It blows my mind when I see someone logged into their bank/email/etc from a public terminal.
I was once friends with a guy that carried around a PS/2 keylogger that he would plug into university terminals for a day or two then pick it up later. He just wanted to see what he could find. He found everything from people doing homework, cybersex, and even bank info. Now if he was actually out to do harm, he could have really made things bad for hundreds of people.
If it's not yours then just assume that it has a loudspeaker on it broadcasting everything you do to everyone around you.
And for those that think cut&paste, screen keyboards, etc will protect them. I personally installed a keylogger on a friend's PC to catch her then, 12 year old son, looking at porn. The log files had a play button which would replay every mouse movement, screen change, and keyboard input for up to 96 hours. This was about 7 years ago so I'm sure they've gotten better.
Your live cd has your security certificate. You have your password. Intercepting your password keystrokes will do no good unless they also steal your liveCD.
They could still have a setup to catch you, but at that level of paranoia you should be equally worried that they will be snooping the electric field of the computer.
Seriously, if your data is THAT sensitive which is to say THAT VALUABLE $$$, simply buying your own laptop is probably a very economic thing to do.
We had an Internet Cafe (through a commercial ISP) at two locations inside the fence. It served two purposes -- first, we had a lot of folks visiting us who might need to access blocked sites. Second, it could be used by visiting foreign nationals who weren't cleared to use NIPRNet (we also had a classified LAN for them to use). We periodically re-imaged the cafe, but we didn't really care enough to do it frequently.
It's always a long day... 86400 doesn't fit into a short.
I keep a no-install copy of Firefox for Windows on a USB key, already logged into my Gmail account (cookies are kept on the USB key), and also with the password saved in case the cookie expires. However more sophisticated attacks are emerging such as cookie-stealing, so this is not as good an approach as it used to be.
When I was in charge of government laptops, we disabled booting off of anything but the hard drive and locked the BIOS with a password. Sure, the user could reset it, but we'd know that they did so.
The point isn't whether you think that what you're doing is OK. The point is that you aren't authorized to make that decision.
It's always a long day... 86400 doesn't fit into a short.
There is no perfect solution to this problem: using a public terminal is fundamentally insecure, and nothing you can do will change that. However, when I am faced with this problem, I log in using SSH and S/KEY. This prevents a key logger from gathering useful password data. You still have to be careful that no sensitive information is inputted or returned, this without fail will go into the hands of your attackers.
"The restrictions in effect depend on the nature of what is being safeguarded; comparing two situations is like apples and oranges."
:)
Very true and *must* be remembered when at a govt installation - especially ones that had ever done nuke stuff at some point. There are MANY reasons for a "secure" rating and it may be more to protect you than the what is inside the compound.
There was an incident shortly after 9/11 where some reporter showed how "insecure" a sight at LANL was by scaling a fence, cutting a lock off a building, and taking many photos. It also included a rant about why spend security on those empty buildings. After some posting across the internet he finally found out why (and anyone who has worked in such installations immediately knew the answer) - the building was contaminated with highly radioactive dust that is nearly impossible to clean up so just lock it off. Yep, that guy sure showed them by breathing in some gamma emitting particles.
I have been in facilities where real weapons research was going on and it had fully manned machine gun turrets and was (maybe) mined outside of the official walkway (the mines were according to lore at the area - hard to know if true though the machine guns were quite visible and would have been sufficient. I know much of the lore about the area I worked in wasn't true and the machines guns should have been sufficient). Never knew what they did there more than "weapons research" - I ate lunch a time or two with one of the principle designers of our Neutron Bomb and that was where his office was and that is far as I knew anything (and wanted to know - you don't ask about those areas).
"FOUO/Unclassified-Pretty much the catch-all for government owned IT-equipment."
I would add that much of what you post is on machines that the IT guys managed. I worked in the research division and because our research was on scalable system administration we did pretty much what we wanted with them. I know a number of other researchers mostly administered their own system as they sometimes required some software that IT wouldn't support.
The security of those systems ranges from good to horrid, shortly before my contract ran out we had an incident where well over 50 systems were compromised due to those peoples computers using a symmetric SSH key system from their office in a university (in this case the person didn't log out of a public terminal telnetted - yes telnetted - to their university desktop) to *all* the machines they had access too. Amusingly enough the hacker had access to the Big Iron machine (an IBM sp2) and didn't know what it was so he went for more desktops. It was an amusing meeting - after two hours of listening to a guy drone on about ssh keys, telnet, encrypted and unencrypted connections, keyloggers on public terminals, etc he asked any questions. First one: "What's SSH?" (note this included the chemists, physicists, biologist, and a few more "..ists" that had no real reason to know, we were all were giggling at this point).
Unfortunately some of the researchers were not very good at watching what systems they ran on. I know of at least once where someone was having trouble running on our stuff and I (being root) logged into their account and debugged their software. Found out later the reason they freaked when I told them what was wrong was that they were in the "sensitive unclassified" category. They had no idea root could do that and figured we normally ran a tighter ship security wise than the official systems did (which in some ways was true, in others not and they found out the latter the hard way).
*note - anonymous because even though it has been a number of years still not sure what I am allowed to talk about. So feel free to write me off
Yes, they ARE a fairly honest scam, they want your money and provide VERY little in exchange. Hell, a Pentium II with less than a gig of ram and 20 gigs of hard disk storage would run a forum and database well enough to collect ALL of someone's graduating classmates and even to provide them with fairly decent IM and Email capacities.
:) Its easily worth the one time payment of 30 bucks for a month or so. :)
However, given that they SELL most of this info (I'm fairly sure they do, judging some rumors that I've seen propagate to other databases.) By the same token, they're a lovely way to spread misinformation about yourself and find out who sells what to whom by watching how the lies propagate
" What luck for rulers that men do not think" - Adolf Hitler
A standard part of Windows. I don't know about other OS'es.
On Windows 2000 (prob same on XP etc) Start / Programs / Accessories / Accessibility / On Screen Keyboard.
Click in your Password field. Enter your password using the mouse on the on screen keyboard. Good enough.
Write a script, that, when run, will set your user password to the top one of a list, and delete that one from the top.
Keep a copy of the list with you, SSH in (or whatever), and run the script immediately.
Assuming no-one tries to log in from the time you enter your password in the Internet cafe to when you run the script, and change it, it's a perfectly safe method.
Get your own free personal location tracker
Is the keylogger the worst thing you could think of?
Now you'r making me really paranoid. Will that public terminal blow up? Was the last person to use it infected with ebola? Are a bunch of pervs scanning me with millimetre waves and publishing it on youTube? Is this terminal used by terrorists, and the police mistake me for one, so that I will be shot as I try to get on a train?
You're right, keyloggers aren't that bad. I hope that I only get my identity stolen and my bank accounts cleared out.
It seems to me that a Blackdog http://www.projectblackdog.com/ might help get around at least some of this problem given the right setup. Think about this scenario; You walk up to the public terminal and plug in the Blackdog into the USB port and it boots up a X-Terminal session on the host, and from there you use ssh and port forwarding to proxy your web traffic to a trusted host at home/work through its ssh VPN. The authentication is done via a secret key stored on the Blackdog and unlocked via something like s/key or a keyring stored on the blackdog, and subsequent passwords could be either injected into the session by the Blackdog processor environment, or stored in a Firefox browser running from the dongle itself. Keystrokes might be visible but if the Blackdog can supply the authentication where needed then the crooks can't reconstruct enough of the session to do or learn anything. Sure they might log a bunch of mouse movements and a few key strokes but they would not even know what application those keystrokes were going to much less what sites you visited.
On a public system, you cannot know that the Firefox you are running does not have some unique modification. Such an approach is way easier than trying to use a keylogger. These days I am very suspicious of public systems that ONLY provide Firefox/other open source browsers. It's probably one of the rare situations where I prefer to use IE. That said, if you use anything other than a throwaway password from a public terminal, you are extremely foolish.
I don't know whether keyloggers like this exist, but unless you physically toggled the power, you may have only thought you rebooted the system. Even still it's possible a false BIOS was installed which lies about the boot order, with a hypervisor booted off a small partition which runs your live CD inside a VM.
But anyway: Hardware-based keyloggers. Even if you check the keyboard cable, it could still be installed inside the case - a lot of USB ports aren't soldered to mainboard. Or it could even be installed in the keyboard itself.
In short, if you want to be super paranoid, you have to assume that any keystroke you make will be captured.
Maybe a system involving single-use SSH keys would be feasible. I'm surprised there isn't some sort of RSA token solution for personal use.
Slay a dragon... over lunch!
Comment removed based on user account deletion
What about the well-hidden pinhole camera aimed over the keyboard? So, after you've mitigated the well hidden hardware keylogger, you still have to cover your hands with a hanky while you type.
I'm sure someone must have said this already, but if you are that worried about keyloggers and such on public terminals, DON'T USE THEM!
I'd strongly recommend that you buy a laptop to take with you on vacation so you can check email, etc. from the road. If you're that paranoid about it then the simplest solution is to not use public terminals at all for tasks that require you to enter private data and make the investment in a cheap laptop.
It's a good point. Even the most thoroughly inspected terminal, if it's in a public location, may still capture your details.
For the most die-hard paranoid, one-time passwords are the only real security you can offer against capture (such that even if they're captured, they're useless), presuming you have a way to look up the one-time password without exposing subsequent passwords (ie, you can't just have them written all on the same sheet of paper, or the pinhole camera could capture the next ones).
Even RSA SecureID is vulnerable if its information is captured by a system able to exploit it in real time, unless the RSA system only permits one successful login per account per minute (the interval it takes the SecureID to refresh its numbers). If the information is precaptured (such as by a camera before you've typed the digits), they could beat you to the authentication. The public terminal could be written to capture your authentication credentials, changed your entered credentials to false ones (to make you think you'd typed it wrong), and perform the real authentication in the background to gain access.
So it comes down to: there's theoretically no way to completely secure yourself when using a public terminal or when using even a trusted terminal in a public space if you are hyper paranoid.
Slay a dragon... over lunch!
Well, you could type a massive amount of random letters into a text document, with your password buried somewhere in the middle. Then copy and paste the password into the password field of the form. If the OS doesn't let you paste into password fields, then you could just have the text doc and web page open side-by-side, type in random stuff, switch to the web page (via the mouse) and type your password, switch back to the text doc, and type more random stuff.
Depending on how much random stuff you're willing to type in, how long your passwords are, and how many times the site lets an attacker try a password, this is at least an annoyance to keyloggers. If you're being specifically targetted I'm sure they could get your password, but it would be enough to prevent 'casual' keyloggers from getting your password, and presumably that's the sort that would install a keylogger on a public terminal.
The last time I messed around with a keystroke logging software, probably 3 or 4 years ago, not only did it log keystrokes but mouse button presses and window changes. So if your password was in the sentence "I know I left my keys somewhere in my house" And tried your method it would record information like:
I know I my keys [Mouse1] [Firefox, Hotmail.com] somewhere [mouse1] [Word, Document1] in the house
So there is no benefit from that method of defense. FWIW, it was an off the shelf program, nothing elaborate or difficult to find.
When i go on holiday i take exactly that precaution. You often cant spend time checking the machine for physical keyloggers because they can be under desks and the ports can be hard to see or reach.
.authorized_keys file. I then make a note on paper (!) to remind me which keys i've used.
You have to assume you're going to be keylogged and design a system that is resilient to it.
I hide SSH keys (encrypted with passwords) around the internet on various web servers. Then i only need to download (and run) portaPUTTY and vnc viewer before i can see a desktop with a web browser with all my passwords set up and all the sites i want to go to as bookmarks tunnelled through a secure SSH connection. With VNC set on low colour the latency isn't too bad and accessing and writing email doesn't need high graphics anyway. Then before logging off i simply delete that key's reference from the
With this method there is no way an attacker at any single internet cafe could access anything i dont want them to. Its not totally fool proof but its paranoid enough for me.
How many computers are too many?
I work for a contractor who does work for the Ministry of Defence and some of our buildings require SC/DV clearance. Taking a phone in any of those would be a disciplinary offence, and may even get the person fired.
The risk to my company of losing it's List-X status (and hence 40% of our work) if there's a breach is too high to be flexible in this regard.