Slashdot Mirror
Tabnapping Scams Around the Corner?
scamdetect pointed us to an interesting bit of news about a new security risk called tabnapping that was recently outlined by Aza Raskin. The short story is that background tabs are updated with login forms impersonating the sites they originally contained, but hosted by helpful third parties primarily interested in your password. (CT:Original writeup removed at request of submitter)
...so are people really dumb enough to go "oh right, my bank's webpage" without realizing they didn't bring it up themselves?
Living With a Nerd
This is why it's so important to check the address of the site you're about to log into.
People who do this crap of stealing people's accounts or identities should be shot.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Obviously, this won't subvert SSL certs or anything; but studies consistently demonstrate that users oscillate between "don't know" and "don't care" about those, so that isn't much comfort.
And, since pages reloading themselves, or even forwarding to a different domain and URL entirely, after a delay is fairly common(if generally annoying) in a wide variety of legitimate applications, you can't really just break the ability to do that. Sure, you could add it as an advanced option somewhere, or get it largely for free with the right NoScript settings; but there is no way you can break it by default.
You pretty much just fall back on the phishing filter, which is a lame, AV-esque "solution". This would seem to apply to all tabbed browsers, as well.
You see this, and think "Why didn't someone think about this before?"
Emotions! In your brain!
Without having RTFA:
That sounds a lot more complicated as you'd need to hack at least one high traffic website, read the cookies stored by the browser, and then force a meta-refresh only when the user isn't looking.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
He could have come up with something a little less douchey than "tabnapping". Next thing you know, everyone will be saying, "I've been tabnapped!"
Maybe it is time for the browsers to take matters more seriously and block any scripts from running in tabs that are not currently in focus.
But this can be done in separate windows too, not just in tabs. In terms of whether this is a new concept, let's just say that I have 'seen' this done 10 years ago to gain access to some chat accounts.
You can't handle the truth.
Not exactly. From his page on this "exploit"...
So his "exploit" is to wait until you are away from HIS tab and then alter HIS tab to look like it is a different site.
Dear Slashdot: I submitted the above story this morning and was pleased when it was accepted for publication on your website. However, I was a little peeved to find that the link I included in the story - was substituted in the final story with this one Obviously this substitution removes any benefit whatsoever of my having taken the time to write the blog post and submit it to slashdot in the first place. Any chance of swapping the link back?
I'm supposed to open a tab, go to a website, open a second tab, go to a compromised website which changes the content of the first tab without my interaction, and then log on to the site presented in the first tab? Don't you think that I'll notice that I'm not on the same website I was on previously?
Seriously, all of these types of attacks rely on the user having the mental capacity of a damp shoelace. Maybe letting them get bitten every so often will teach them to pay more attention to what's going on, and not blindly click away every message box or enter details into every site they're presented with.
Finally had enough. Come see us over at https://soylentnews.org/
Just give me something without sugar!
who develop these attack vectors used half of their creativity on a legitimate purpose, they'd make 10x the money and earn it completely honestly
i mean this is a brilliant attack. so, whoever thought this up, why aren't you making millions in a respectable way? you obviously have the brains to do that
some people just have to be assholes
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Simple solution - don't use tabs in browsers. The first thing I do to any browser I sit in front of, is to immediately disable the use of tabs. I have never understood why many people think they are a good idea - I think they break a heap of good UI principles.
My two cents as far as tabs go, is that a window should be a window - not a collection of tabs - for the simple reason that tabs obfuscate (hide) the content within. Yes, I can see the advantages of tabs within some UIs in certain situations - for example: segmenting "general" from "advanced" preferences; stepping data through a process, or in a rich client application where data is related.
Where tabs are a bad fit for browsing is that the data viewed in web apps is often too disparate - there is no linkage between any of the tabs within a "window" - the content of what is presented within is asynchronous and disconnected - tabs in browsers never have a true relationship with each other. Sure - you might be looking at two related sites, or two pages within a site, but tabs offer nothing (UI-wise) that a window cannot do. A new window offers a single view of a chunk of information; if you need another view, why not simply use another window. A mish mash of windows filled with tabs does not improve the UI in any way.
This attack only works if you allow Javascript by default, instead of only whitelisting sites that you trust.
Can Javascript really access other tabs or windows? Shouldn't it be restricted to its own page/tab/window?
like you said, you are logged into Facebook right now. Would you not find it suspicious if when you clicked back over to it, you were greeted with a login screen?
A lot of web sites periodically invalidate session cookies after 24 hours. In that case, the next link you click even on the legitimate site will present a login screen.
Not trolling, just peeved that my link was ripped out yet the body of the story is identical
Now to get to work. Those accounts aren't just going to empty themselves now are they?
No, because this is REALLY dangerous for Yahoo Mail.
I'm logged in, and it likes to revert back to login pages all the time! It even makes you login twice "to check your security". So this TabMcNab exploit is going to be really dangerous somewhere. I'm pretty sharp, but that page has cried wolf so many times I would have fallen for this if it was grade-A delivered.
You're trolling. This is CmdrTaco's site. Just be glad kdawson didn't get your story, or he would have put "pwned" in the title. Your link doesn't matter. Get over it.
i am so goddamned tired of hearing these stories that say "oh noes, stupidity might be painful, what will we do, it's so terrible, simpwy tewwible!" if you are stupid you should not breed. if you are stupid, nature has only ever had one cure for that, a little good old Darwinism natural selection. why the fuck do we care so much about them getting ripped off and having some money taken away when we should be sterilizing them surgically?
Even if the scripts are completely disabled on the page, what about a delayed HTTP response, in effect a push to the browser by a server that is done sometime after the page is loaded as a delayed response to the browser request?
It's really hard to avoid all possible scenarios on how a page can be changed from something to something else.
You can't handle the truth.
AND if you're not using noscript (or equivalent) or you allow that site to run whatever javascript it wants. And so forth.
So this is a pretty clever thing to do. The issues here are that it's sneaky, remarkably effective (even against those who are security-aware), and difficult to stop, since tabbed browsing is generally regarded as a good thing.
One possible solution would be to have browser support for user-opted website whitelisting. When you visit a site where you require security (banking, etc.) for the first time, you can configure your browser to add the domain to a security-aware whitelist. Every time, from then on, when you visit that page, your browser visually (and obviously) marks that page (gold border, animated lock, etc.) if its SSL credentials check out. As a user, I would simply have to know "always check for those visual effects before you enter your banking information", which is not a hard thing to remember.
Another would be to have a browser-supplied interface for entering credentials that can be invoked by the site. You click the log-in button, your browser supplies a "Guaranteed Secure" login modal dialog, you enter your information, and your browser then forwards it to the page and logs you in. You can then add important domains to the list, and your browser will never pop-up that dialog for a page that isn't on that list. Same as above, you would elect to whitelist sites that are important in advance, and because it's a browser-supplied login, no fake tab (or fake SSL certificate) will be able to induce that dialog.
At some point, people will figure out clever ways around things. The browser needs to be able to accommodate the idea that every page on the Internet is not equal from the point of view of the user. There must be a mechanism by which the browser can allow a user to easily (visually) differentiate between a legit page and one that has made itself look legit.
As far as I can tell, the script merely waits a while (hoping that the user's attention is diverted) before changing the contents. Surely, the same idea works about as well if the user uses multiple windows rather than multiple tabs. Just as soon as attention is diverted from the appropriate browser and it is covered by other windows, the content could be changed without the user noticing.
The only difference is that, with multiple windows, a portion of the window may still be visible when the user is looking at another window. In my limited experience, folks tend to maximize windows anyway (I *hate* that!), so that's not a significant issue.
Am I missing something?
Phiwum's law: anyone that names an obvious law after himself and then puts it in his own sig is just pathetic.
You are not to blame, because even the browser creators misunderstand ssl.
-Ssl does not mean that it is save to input credentials.
-More gui does not not help much.
-If a site makes an error with ssl (expired, or changed subdomain) you only have a all or nothing option.
As your parent article states, there already is an option to only enable javascript on trusted sites, (noscript), but this relies on whitelisting particular sites. Only securityparapoid people (like me) use it.
and here I thought the article was about falling asleep on your keyboard while waiting for IE to bring up the next tab....
I know, I use IE. It's not my fault. The government is forcing it on me. I also get to literally watch my html scan in as McCrapafee HBSS IPS grab my CPU by the neck and chokes the life out of it.
A way to mitigate against tabnapping (and a lot of other phishing) would be for web sites to use http authentication rather than 'pretty', but easily spoofed web page login forms. That way it's quite clear what page you're trying to log in to becuase login is through a hard-to-simulate browser dialogue box which states the target web address. Even quite clueless users might start looking more closely when phisingsite.example.com starts prompting them to log in.
I tried it out and Protected/Froze/Locked the tab and the exploit ran.
I think it's because the full contents were loaded and it didn't actually try to navigate anywhere.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Use Opera's script blocker or NoScript on Firefox to stop this type of attack.
Also on the proof of concept's page, the contents changed to look like Gmail. The favicon and the address stayed the same. Tested on Opera.
Many AJAX sites depend on similar functionality. I recommend whitelisting JavaScript allowed sites on your browser.
My brother always told me that tabs were bad
Call these surfingly-transmitted diseases. It's amazing how apt "safe sex" is here. You need to not only consider that promiscuity will catch you something nasty, but that promiscuity of your partner (the website) will do so too.
I'm a paranoid computer scientist who has been anticipating these vulnerabilities for as long as I've seen the web being corrupted with "active content" designs. I start browser sessions frequently throughout the day. I do not persist any cookies between sessions. I use NoScript (as of late) and privoxy (for many years) to block out most potential content. I use GNASH rather than Adobe flashplayer. I use xpdf rather than Adobe acroreader. I have a mental model of trust equivalence classes for all sites I visit, and I never mix trust classes into the same browser session. For critical stuff like banking, I never open more than one website per session, not even trusting one bank nor credit card site to run alongside another, even though they both control my money to some degree.
Lately, I have been considering that my methods may not be secure enough, so I may start using additional user accounts with separate browser state on the filesystem, to better sandbox the browser from my working data and from other browser instances.
It's conceivable, especially under this circumstance, that an already open (let's say) Gmail page is re-written. What's the first thought that might come to mind? Oh, it auto logged off - only to have people "log back in". Agreed. This issue has potential. Bring out the fixes - soon!
L'esperienza de questa dolce vita (The experience of this sweet life) - Dante Alighieri, The Divine Comedy
"Slashdot is about news, not driving traffic to someone's website. And 'getting traffic' is not some kind of exchange or reward offered for submitting an article. If a different link is editorially better, then it is expected that the editors will swap it." - by mysidia (191772) on Tuesday May 25, @09:42AM (#32335284)
Ahem: BULLSHIT! Slashdot's altering scamdetect's post is doing EXACTLY WHAT YOU ACCUSE SCAMDETECT OF (basically): Slashdot's editors altering scamdetect's source data is directing traffic to a "crony" of these so-called story editors' favorite/pal/affiliate (their crony in other words) site imo @ least... taking/playing "favorites" in essence.
Krebs on security appears to be a "crony" (or what's the word SEO optimization scammers use? Oh, yes: "Affiliates") of the editors here!
AGAIN: The editors here are in fact violating what you said yourself about "driving traffic to someone else's site" (which is EXACTLY what they're doing by taking out the url link that spamdetect put up, and putting in one of the slashdot editors' own choice instead).
After all - Neither Kreb's article (dated Monday, May 24th, 2010 at 9:07 pm) nor the one scamdetect put up (dated today, Tues. May 25th, 2010) are the original discoverers of this material, so neither one's date data really matter either, as to "whom posted what first"!
Nor is either one better than the other, imo @ least, editorially!
(Now, as far as MY credentials in this field? Ok - I am a multiply degreed college grad here no less in both CSC & MIS, complete with all the English you'd ever need in both of those degrees I have on the subject of computer sciences (along with 16 yrs. of professional experience on my part & being multiply internationally published for my works in this science, plus being featured as tech shows like MS TechEd 2 yrs in a row as a finalist for commercial code work & ideas in the hardest category there in SQLServer Performance Enhancement while on paid contract to do so increasing the programs used effectiveness by 40% or more (block level device driver work & data structuring in said commercial wares of "Enterprise Class" scale classification) for them no less also)).
I wonder who is more qualified on the subject of computing here... myself, or the "editors of slashdot"? I say that, because I disgree with your statements/thoughts, strongly, and I wager that the story editors here aren't even as qualified on this science & subject as I am (nor moreso on their parts in English either).
Secondly: What exactly qualifies Slashdot's editors as to "what's better editorially"?
Again - Do they have degrees in English to substantiate that they themselves are "expert" on what's better, editorially??
I'd wager not.
Man - You're the pot calling the kettle black man!
(Plus, this isn't the first time I have seen this type of shenanigan out of slashdot (or other news websites) either!)
This happens ALL THE TIME (in catering to "partners/affliates/favorites" (spelled sideways = CRONIES!)), & I also feel it's wrong as well.
APK
P.S.=> Bottom-line? Well, I also think scamdetect has every right to be upset that his submission was altered by the story editors here, as to the link submitted data as the source, because I'd actually wager that Brian Krebs may no more qualified as an expert in this area than are the folks that scamdetect originally initially used as his source data in fact - unless someone can show me that Brian Krebs has his CISSP certification, or an actual A.A.S. or B.S. (or better in post grad masters or doctoral work) in CSC related disciplines (or, those CSC degrees specifically those related to computer security actually)... apk
Why not use different profiles with the -no-remote option? Even if you have multiple tabs open and multiple browser windows, have a profile for financial operations only, or whatever you want to protect and have a persona that is easily recognized for that purpose. Then browser history with personal finance history will not be exposed to your other browsing.
See my reply here to your "naysayers" -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32336794 & see my subject line above scamdetect.
APK
Except that so many websites are JavaScript dependent that temporarily allowing JS from a page is fairly common for all but the most paranoid. Design your malicious site to be unusable without JavaScript, 90% of NoScript users will at least temporarily whitelist it if the content is of sufficient interest; I recommend porn. When they quickly switch tabs so their bosses don't see the porno site, switch to a fake log-in screen.
Yeah, most people will catch it, but you aren't coding for most people. You're coding for dumbasses (or people ignorant of this exploit with little native skepticism), and even among NoScript users, I guarantee a few percent of them forget what they were doing, overlook the address bar, and rationalize the log-in screen by assuming they must have opened it and forgot about it, then remember something they needed to do and enter their log-in details.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
So a page renders itself then waits until it's inactive then rerenders it won't take long for a patch.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
Brian Krebs doesn't have a degree in CSC, CIS, or MIS (nor a CISSP or like computer security cert. to his credit (I just checked on this in fact, after I wrote the material I have here now and in the URL I put down below here, which was my original reply to your "naysayers" here)).
After all - Neither yourself, NOR BRIAN KREBS, are the discoverers of this material, so the date data is immaterial (don't berate yourself on that account spamdetect, yours is just as valid as his is, and, to be honest about it? I found YOURS easier to read (shorter & to the point)).
Here was my original reply to your naysayers, so, "drink it in, & digest it" -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32336794
APK
P.S.=> Others here in this very thread are also noting that slashdot's "editorial crew" (what exactly makes them expert in being professional editors anyhow, especially on the note of English & editorials? I bring that up in my URL above, & especially on the subject of computing no less) tends to "favor" their "crony" Brian Krebs here on this website, constantly it seems!
It's NOT just me saying it either, as it's also noted by others here as well on this very subject -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32335196 and it was uprated +1 already too, so... apk
Ive never understood tabs myself. I already had tabs built into my operating system, they called it the taskbar. What's the vulnerability being attacked here anyway? I know of no way for content in one tab to insert content or even change the location of another tab ...
*DrugCheese rants*
I think I'd want to have some kind of referendum on what "stupid" is before I'd agree to the whole sterilization thing.
And as far as natural selection taking care of stupidity, it much more often seems like the stupider one is the more their reproductive practice takes on a pattern similar to that of voting in Chicago: early and often.
I don't see why it would be so hard for Firefox to simply report to the user a warning when they begin to send a particular password to a "new" site, one that they haven't sent a password to before, and even more-so if the password is generally sent to another site.
I think this solution fits the problem well, as you're trying to prevent yourself from sending passwords to places that shouldn't get them.
.. leave your bank tab open and walk away.
Sure I'll leave facebook or gmail open, but there's limited damage that can happen from someone hacking them.
Also for some reason i usually have two windows open, one for "serious business" where gmail is the first tab, facebook is the second tab, then what ever else i happen to be looking at in the other tabs. Then in a whole other window there's the random youtube, flash games and stumble upon results. Always keeping facebook and gmail in the same tabs limits the chances of me being tricked by this by anything i regularly log into. WTF is gmail doing all the way over here!?
Eschew Obfuscation
No to the above... now, as to what YOU stated? OK:
"Of course you think your blog was better than krebsonsecurity, but personally I almost never click on any link with "blog" in the name, especially from slashdot." - by mcgrew (92797) * on Tuesday May 25, @10:18AM (#32335816)
http://it.slashdot.org/comments.pl?sid=1664046&cid=32336794 in my original reply here (thanks for the "+1 mod up" to whomever up modded my post here, because it's a serious rarity for us AC's to get EVEN THAT level of moderation upwards, considering our posts are often buried because we're not foolish enough to register here to be easily tracked for trolling registered users and the fact that we start at ZERO/0 mod points)!
I said that in that URL above because I agree (along with many others here such as this one, also moderated upwards here for the same basic points I made in my URL above -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32335196 ) that spamdetect was done wrong by the editors here, and his asking that his original data link as the source be reinstated (or, at least, co-posted as a secondary substantiating source).
APK
P.S.=> Kindly show ANY OF US, that Brian Krebs has a CISSP, or an A.A.S./B.S., masters or PHD in CIS, MIS, CSC or other computer sciences related disciplines (plus an English degree to his name also) that qualifies him as "better or more expert" on the subject of computing (specifically security would help even more)? Then, we'll listen... otherwise, you're appearing to myself as another "let's butter up the owners/mods at slashdot" type (a crony/sycophant/bootlicker, if not one of the mods/owners here defending himself via alternate logons (if you guys do NOT think this occurs on websites? LOL, boy... are you naive!))... apk
Have YOU even passed a formally administered LOGIC course? I think not, and it's because you're appealing to an incorrect authority (a major logical fallacy tenet in fact, on your part, lol).
"It's guaranteed to be brought up by some nincompoop who missed Logic and Philosophy in his education. Krebsonsecurity is better, if for no other reason that it is better known." - by NeutronCowboy (896098) on Tuesday May 25, @01:06PM (#32338036)
Ahem: I actually took, and did fairly well, @ LOGIC while in academia, have you? Obviously not, and all your name calling's only showing that's the "best you've got" (but no coursework in logic to your credit obviously, other than the "pseudo logic" used on forums, lol!)
(Obviously you have not taken LOGIC on YOUR part, and certainly not in CSC, because if you did, you'd realize it's commonly a requirement for said degree (At least in the "best schools" which are typically found in the North East United States and that's where I took both my degrees!))
You failed, and why? Because of what you used... in LOGIC, using what you have is called (so you know) an "appeal to an incorrect authority"!
Calling Brian Krebs somekind of expert or authority on this arena of computer sciences? A mistake, and a huge LOGICAL one!
(Krebs has nothing to his credit in this science in degrees that establish his expertise according to educational standards, and I also DOUBT STRONGLY he has put in his "time in the trenches" either in Computer Security, Networking, OR PROGRAMMING as well which might help establish he as more of an "authoritative figure").
You? LOL, my man... I have to thank you, for defeating YOURSELF ON THE VERY GROUNDS YOU USE YOURSELF:
You just failed a major tenet of logic, in your "appeal to incorrect authority" by the way, because Brian Krebs is by no means, an authoritative figure in this science, let alone the specific niche in computer security (he's more of a hobbyist, and thus, no more qualified than scamdetect here is)...
However, since you critiqued ME? See this list, show me you (or Krebs) have done more or better in this field:
"My Name is Ozymandias: King of Kings - Look upon my works, ye mighty, & DESPAIR..."
----
Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61
(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).
WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)
PC-WELT FEB 1998 - page 84, again, my work is featured there
WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there
PC-WELT FEB 1999 - page 83, again, my work is featured there
CHIP Magazine 7/99 - page 100, my work is there
GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it
HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!
Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only...
Lastly, being paid for an article that made me money over @ PCPitstop in 2008 for writing up a guide that has people showing NO VIRUSES/SPYWARES & other screwups, via following its point, such as THRONKA sees here -> http://www.xtreme
As the richness of the web experience increases due to interactive technologies available on the client-side unscrupulous people work to catch people off-guard for their own advantage. At the most benign level this is done by advertisers seeking to gain attention. At the worst thieves use client-side scripting as a virtual pickpocket tool.
When possible I remind my family members to stay on alert when on-line (or even off-line). This includes not clicking on links in email, of course. It also includes not logging into a service unless they have entered the URL themselves or used a bookmark they have set up. Yes, this does not prevent MitM attacks and will not protect them from a scheme that changes a browser's bookmarks. But it solves the bulk of the phishing attacks to date.
One reason I prefer specialized apps for important services (banking, on-line status update services, email) over using a generic web interface is that specialized apps are less prone to be faked by XSS, phishing look-a-like pages, etc. This is especially true of closed platform apps like iPhone/iPad apps that undergo an approval process by a third party.
Sad as it is to admit one benefit to the lack of "freedom" on the iPhone/iPad platform is protection from scammers.
What is an open alternative to protecting the unaware from these scams? I'm all ears.
-- @rjamestaylor on Ello
So don't use tabs..."tabbed browsing" sucks anyway.
otherwise, you're appearing to myself as another "let's butter up the owners/mods at slashdot" type
Ok, I'll clear up a few things:
Yes, there are people with alternate logons; but I've had exactly two; this one, and when when I lost my password for a time used this one. One would think that a person would friend alterate identities; you really think I have over 200 alternate identities?
The fact is, I'm simply a longtime slashdot reader who loves the site and tries to contribute the best I can.
As to "mods", I post too often to get mod points (although I get metamod points).
we're not foolish enough to register here to be easily tracked for trolling registered users
Too bad you're not registered, because you'll probably not see my reply. That's an advantage of being logged on -- you're informed of replies to your comments and can have an intelligent conversation with people way more knowledgable and intelligent than me; one of the great things about this site is you can actually LEARN stuff sometimes from some of the comments. Scientists from all sorts of disciplines, engineers, designers, from all over the world post here. You're not going to find discussions like you see here at DIGG, or anywhere else for that matter.
Free Martian Whores!
Requoting you, on blogs, per my subject line:
"Of course you think your blog was better than krebsonsecurity, but personally I almost never click on any link with "blog" in the name, especially from slashdot." - by mcgrew (92797) * on Tuesday May 25, @10:18AM (#32335816)
First of all, "Krebs on Security"? It's a BLOG, correct? I'm pretty sure it is, so you either are joking or are contradicting yourself...
"Yes, there are people with alternate logons; but I've had exactly two; this one, and when when I lost my password for a time used this one. One would think that a person would friend alterate identities; you really think I have over 200 alternate identities?" - by mcgrew (92797) * on Tuesday May 25, @02:34PM (#32339464)
Thanks for making my point, that's a possibility (others are for others that 'support themselves' via multiple alternate logons as registered users too are another though, & that's what I allude to actually)... there is also another case you omit: WHEN SLASHDOT MODERATORS HERE DELETE OTHERS' ACCOUNTS TOO, AS NOTED HERE:
----
http://slashdot.org/comments.pl?sid=1640368&cid=32155438
"so if you try to block all of my posts like the other one that are here then every thing i have heard about the moderators is true and all of the Slashdot moderators is nothing but a bunch of losers that can not handle the truth, and if you think taking my account and destroying kingersjokwers was going to stop me from posting the facts then you are out of your mind" - by kingsjokers (1808300) on Monday May 10, @10:52AM (#32155438)
----
"The fact is, I'm simply a longtime slashdot reader who loves the site and tries to contribute the best I can." - by mcgrew (92797) * on Tuesday May 25, @02:34PM (#32339464) Journal
Same here, but, when I see the likes of what is in bold above, and whats gone on with spamdetect here too and his posting being altered to cater to what appears to be a 'crony' (or, shall we say "affliate", lmao) site for this one, & I'm not the only one noting it here either, this person has as well -> with the same sentiment.
When I see /. mods:
1.) Unfairly apparently burning others accounts, stopping them from submitting posts or points in doing so:
http://slashdot.org/comments.pl?sid=1640368&cid=32155438
"so if you try to block all of my posts like the other one that are here then every thing i have heard about the moderators is true and all of the Slashdot moderators is nothing but a bunch of losers that can not handle the truth, and if you think taking my account and destroying kingersjokwers was going to stop me from posting the facts then you are out of your mind" - by kingsjokers (1808300) on Monday May 10, @10:52AM (#32155438)
2.) Trying to do the same to others (or, lol, TRYING to & failing, lol -> http://slashdot.org/comments.pl?sid=1640368&threshold=-1&commentsort=0&mode=thread&pid=32085128 as they did with myself & others too there)
3.) Then the mods here also stopping threads early when the mods/owners or their pals "bit off more than they could chew" with facts vs. their fictions (soppsa & red flayer mods here afaik (red says he is, soppsa I am NOT 110% sure of though))?
"Germany warns users against Firefox" here http://slashdot.org/comments.pl?sid=1640368&cid=32111672
They closed a thread 2 weeks early there, last month, on Firefox vs. Opera where I debated it with a user here named clone53421.
Damn you Opera! If you hadn't invented tabbed browsing, none of this would have happened!!
?
Answer the question above in my subject-line & of course, where you tried your "ILLOGIC LOGIC" on me, here, trying to pitifully 'troll' me -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32338386 ... lol!
(Take a course in logic, won't you, first, before trying to tell us how "logic works", lol!)
APK
P.S.=> Windows IT Pro magazine which I had work featured in that I made better by up to 40% due to work on block device driver parameterization & data placements + more?
Well, lol, IT IS TRULY, a "review by peers", because in case you haven't noticed?? Dr. Mark Russinovich, PHD, of Microsoft writes for them...
(So you know: What is/was "Windows NT Mag" where my works featured while you were still in diapers?? It is the forerunner of "Windows IT Pro" mag)...
Also, when you can show you have code in commercial products as I do, well... especially ones that have done really well (such as at Microsoft Tech Ed 2000-2002 as a finalist in its HARDEST CATEGORY, 2 yrs. in a row, & again, most likely whilst you were in diapers (again, lol))??
When you can evidence more than 16++ yrs. of professional experience in this field coding, network engineering, and far more in as I can???
Well... then, & ONLY THEN, can you talk as you have to me, especially your first reply!
(QUESTION - Do you have a degree in CSC or CIS/MIS even? Your outright laughable blunder on logic evidences otherwise, lol, in your initial post (per my subject-line))...
So all the name tossing in the world & attempts @ "sly ridicule" (is your fav. color 'transparent' or what)? Useless, & again, especially what you said about me initially calling me a "nincompoop" (the last resort of the troll usually is name tossing by the by), when I am actually a someone who HAS TAKEN, & DONE WELL IN, LOGIC FORMALLY IN COLLEGIATE ACADEMIA?
LOL, you blew that too, badly, by your fail in the use of "appeal to an incorrect authority", lol, while trying to tell ME my logic was poor! You, obviously, only know "forums 'illogic logic'" (as Tom Baker as Dr. Who called it, lol, "illogic logic")!
Hilarious, & again: "too, Too, TOO EASY!"... just too easy! apk
Alexander Peter Kowalski (since you insist on people using your full name), thank you for that morning of entertainment. Your level of delusion and OCD-ness is both side-splittingly hilarious and saddening. It's like watching a train-wreck. I know I shouldn't laugh, but the self-inflicted nature of the wreck is what makes it so damn funny.
Those who can, do. Those who can't, sue.
"Alexander Peter Kowalski (since you insist on people using your full name), thank you for that morning of entertainment. Your level of delusion and OCD-ness is both side-splittingly hilarious and saddening. It's like watching a train-wreck. I know I shouldn't laugh, but the self-inflicted nature of the wreck is what makes it so damn funny." - by NeutronCowboy (896098) on Tuesday May 25, @05:04PM (#32341426)
Well, see subject-line above, & I could not fit in the ENTIRE truth of it, in "DEFEATED TROLLS" (regarding yourself, a self-defeating troll, lol, no less)
I mean, hey: Your "illogic logic" here, lol -> http://it.slashdot.org/comments.pl?sid=1664046&cid=32338386 was utterly hilarious!
(That URL above's for others reading here, because NeutronCowboy "nuked himself" right out of the gate, lol, on LOGIC (never even haven taken it himself, failing badly in logic no less himself via "appeals to an incorrect authority", AND LASTLY, He obviously never has taken logic (or the topic of this thread, in Computer Sciences related material) academically either because CSC demands usually you take LOGIC... All the while, with "Nuked Cowboy" (lol) here blowing it on that too, & yet attempting to berate + ridicule me who has in academia during CSC degrees work here, & myself actually having done well academically @ LOGIC courses no less too)).
Man - "Nuff said", & "too, Too, TOO EASY" about 'sums it up' for me in that URL above... lmao!
APK
P.S.=> By the way, the initial "nincompoop" insinuation you literally stated & tried to direct MY way, especially regarding having taken LOGIC (when I have)? Hilarious, but you also violating a tenet of logic in your misuse of "appeal to an incorrect authority" clearly evidences that now all you have is your name calling... the LAST RESORT of the fallen troll, everytime! apk
The real smart users don't do "real things" via "go back" or "left open" windows. When I bank etc, I use a freshly opened window (if not always browser, but one can only by so paranoid) opened with file-new not ctrl-n etc. Then I do my business and get out.
Sure my slashdot.org and my social and dating site kinda crap stays logged in, but so what.
If it's real business I don't go there unless I typed the URL by hand. I don't even bookmark the sites for my bank and credit card etc because _I_ have been expecting the bookmark rewriting attack as more likely than tab reassignment. But who am I to judge...
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
"You have evidence of this accusation against the integrity of Slashdot's Editors and (therefore) the Slashdot site itself?" - by mysidia (191772) on Tuesday May 25, @08:48PM (#32343692)
Per my subject line above? This is only a SMALL SAMPLE from this thread where others have noted the same (see url below, it's another respondent here stating that /. tends to "favor" KrebsOnSecurity, because of the mods directing traffic to B. Krebs blog, via altering the original submission for story by the poster scamdetect):
http://it.slashdot.org/comments.pl?sid=1664046&cid=32335196
Nuff said (& I didn't say it either that time, so, good enough for you? It ought to be, & there are others like it here as well besides his statement there).
----
"You claim the foregoing, and yet, you are posting this anonymously, and not identifying yourself, or showing any cause that permits an unbiased reader to believe you actually possess credentials like that (other than you claim to have them)." - by mysidia (191772) on Tuesday May 25, @08:48PM (#32343692)
OH, I suppose for the first item in this list, you could email Mr. Eric Dickman (CEO of SuperSpeed.com, a certified Microsoft Partner) in regards to paid work I ended up doing for his company as EEC Systems back in 1996 that made their SuperCache/SuperCache II block device driver level diskcache up to 40% better for example (easiest one for you to verify I guess would be that, from this list below):
"My Name is Ozymandias: King of Kings - Look upon my works, ye mighty, & DESPAIR..."
----
Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61
(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).
WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)
PC-WELT FEB 1998 - page 84, again, my work is featured there
WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there
PC-WELT FEB 1999 - page 83, again, my work is featured there
CHIP Magazine 7/99 - page 100, my work is there
GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it
HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!
Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only...
Lastly, being paid for an article that made me money over @ PCPitstop in 2008 for writing up a guide that has people showing NO VIRUSES/SPYWARES & other screwups, via following its point, such as THRONKA sees here -> http://www.xtremepccentral.com/forums/showthread.php?s=ee926d913b81bf6d63c3c7372fd2a24c&t=28430&page=3
----
What do I have to say about that much above? I can't say it any better, than this was stated already (from the greatest book of all time, the "tech manual for life" imo):
"But by the grace of God I am what I am: and his grace which was bestowed upon me was not in vain; but I labored more abundantly than they all: yet not I, but the grace of God which was with me." - Corinthians Chapter 10, Verse 10
(And, because I got LUCKY to ha
"Ah.... the moral relativism argument. How do I miss thee.... wait, I don't. It's guaranteed to be brought up by some nincompoop who missed Logic and Philosophy in his education." - by NeutronCowboy (896098)
on Tuesday May 25, @01:06PM (#32338036)
Funny how you won't show you have taken, and passed, a formal logic course... because you obviously have not, per the below evidences thereof and your own poor showing in the use of logic in debate!
LOL, not only did you:
1.) "Appeal to an incorrect authority" (another logical fallacy, because B. Krebs whom slashdot moderators unjustly altered scamdetect the story submitters post here for with one of their own sources? IS an unqualified one no less (because B. Krebs has no CSC, or CIS/MIS degrees, industry hands on experience in the trenches in networking, programming, OR SECURITY, nor does he have a CISSP cert. to his name either - he's really no authority on this subject because of the lack of those things showing he is)!
2.) You're now, and originally as well from the onset of your replies to me here, also resorting to this logic fallacy as well (failing badly yet again & yet you said what you did above? Please...):
Ad Hominem This is committed when we attack a person and not his arguments.
(More evidence to that, directed my way in your name calling attacks & insinuations (as well as your delusions of grandeur, lol, in imagining yourself a licensed practicing psychiatrist as well no less apparently based on what you state below) from you exists below in this quote as well)
"I don't know if it is the foaming-at-the-mouth superiority complex" - by NeutronCowboy (896098)
on Tuesday May 25, @01:06PM (#32338036)
Ahem: Care to produce your PHD in Psychiatry, as well as your license to practice it? Have you performed a formal evaluation of myself in professional settings as well to make your "prognosis/diagnosis", Dr. Quack? No to all of the above???
Thought so. You're libeling me if you don't have those things you know...
(By the way? Thanks for the (sort of) "Freudian Slip", in your basically insinuating you feel I am "superior" - you give away a lot, & I strongly suggest you never, EVER play poker... you tip your hand & show your tell, way too easily!)
APK
P.S.=> LOL, all in all: You should not have brought logic into this, name calling & all as you have (directing it my way), because you've failed on those grounds, HUGELY, no less... lmao! You chose your nickname/handle here, you are truly, The "NUKED COWBOY" (because the flames & smoke from your 'showing' here? Man, they're POURING off of you know, because of it)... apk
It still all boils down to the fact of clicking on a suspect website link...
Dont click on dodgy links -->and you have no issues!
Perhaps I have misjudged the purpose of the Slashdot website and perhaps I owe it's creators/owners/moderators an apology. It appears that whilst relying upon user input for its existence (and the time said users take to craft meaningful and useful content) it is the prerogative of the owners to take said content and rewrite it in the interests of the reader. As a blogger, I find this concept difficult to understand as when guest bloggers or contributors provide content for my website, I ensure that their links are preserved as written to give them the benefit of subsequent referral traffic. I had not realised that the courtesy of reciprocity did not apply to slashdot contributors. For my ignorance in this matter, I apologise.
"LOL, now you've done it, you've set APK off." - by Anonymous Coward on Wednesday May 26, @02:11AM (#32345400)
Per my subject above, I'm far from "set off": I just feel the same "righteous indignation" that scamdetect does, because the moderators here have LITERALLY tried to 'snuff out' my ability to post here a few times (and they failed at it, & quit doing it), and I do not mean the "10 posts per 24 hour limit" that is imposed on those of us that post as "anonymous coward" (better than being an easily tracked for getting trolled registered user imo - because I've got my own "little fanclub" of trolls online and here that try to 'get my goat' that way, & doing AC posts here protects me from that type of thing occurring is all. Otherwise, I'd be a registered user here!)...
The mods here also have closed threads way, Way, WAY earlier than normal as well when I was getting the better of one of their cronies/pals in clone53421 (when I showed that Firefox had 3 security vulnerability errors in 1 week's time and Opera had ZERO & is just plain faster and has more features "built in natively" by far, than Firefox does (with less vulnerabilities than FF addons do also historically)).
I just do NOT like what I feel are "injustices done" online, or otherwise. A lot of folks keep their mouths shut and stay out of things, & many times I do the same - this is not one of those times though, because I know how it feels.
So, do I understand HOW scamdetect feels, when the mods here altered his story submission posting to point to a "crony" of theirs, vs. using the source scamdetect posted?
Absolutely.
That's VERY UNPROFESSIONAL EDITORIAL WORK, and with obvious "ulterior motives" also... & I am not the only person who felt that way here (scamdetect certainly did, that's no secret, but there are others here who saw the same as I as well, a list of their posts are below in url linkage form in this very thread):
http://it.slashdot.org/comments.pl?sid=1664046&cid=32335196
http://it.slashdot.org/comments.pl?sid=1664046&cid=32334930
http://it.slashdot.org/comments.pl?sid=1664046&cid=32335816
http://it.slashdot.org/comments.pl?sid=1664046&cid=32336338
(Want more? Folks in those posts are noticing how OFTEN slashdot's "editorial staff" here link to B. Krebs BLOG, and he has no more qualifications than does the story submitter in this area, Computer Sciences and specifically of a security-oriented focus (hell, I have more under my belt BY FAR than Mr. Krebs does, which only shows that the editors of /. have chosen a source that's really NOT that "expert" or "credible" (albeit, to Krebs' credit, he doesn't CLAIM TO BE AN EXPERT @ least)).
APK
P.S.=> Others realize that /. OFTEN "follows its own agenda", but their favorite color MUST BE 'TRANSPARENT', because as the saying goes, "it's ALL about the 'benjamins'", & perhaps /. feels that B. Krebs (because of the sites he is "affiliated with" are more largely travelled than is scamdetect's, but in the end, it turns up that Krebs is no more qualified as a valid expert on this subject matter than is scamdetect (and neither Krebs nor scamdetect are the original discoverers of this news' topic either, mind you - they're only both relaying it to the rest of us is all, so imo @ least? BOTH sources should be cited, out of fairness, if anything - that's all!))... apk
At least his name carries a lot of weight: http://www.jeremyreimer.com/phpbb2/viewtopic.php?t=4128 and http://www.thorschrock.com/2008/05/19/how-to-respond-when-people-threaten-to-sue-you-on-the-web/
"THOR SCHMUCK"? LMAO, well, people can read there, and see that he refused to answer my points there when I replied (on PING.EXE, SPYBOT SEARCH & DESTROY, & MORE)
He is, afaik, the one that submitted my app to CA as a malware (& it's not intended for that kind of use, I wrote it in good faith for a forums guy that wanted a way to launch OLD Apache server for Windows like a service, invisibly, & since that's only 1-2 lines of code to do? I did!).
CA, now there's a story. Ask Computer Associates about their being caught in a millions of dollars financial/accounting scam, here:
http://www.associatedcontent.com/article/215116/computer_associates_cofounder_led_22.html
Real reputable company, eh?
In fact, I passed every single one of the 21 questions for removal of my ware from their site, & all they ended up doing was lowering it down to a "zero threat level"... but, I'm not too concerned about it, because they also do it to others (along with other Antivirus/Antispyware companies, and we all know how "effective" those are, especially lately vs. today's "blended threats").
Ask Dr. Mark Russinovich of Microsoft or Nir Softer of NIRSOFT if they've ever had their numerous apps libeled along with themselves in the same manner... (answer = they have, so I suppose I am in "good company" here, eh?)
Thor Schrock, lol, another "credible expert" (NOT): That guy doesn't even have a CSC degree or even a single A+ type certification to his name.
APK
P.S.=> All I can say to and about Thor SCHMUCK, is this: GOD BLESS TY TYMKOVICH (LOL, run that by him, it ought to be good for a laugh... the fool got wickedly SUCKERED by him to the tune of $5,500)... apk
"THOR SCHMUCK"? LMAO, well, people can read there, and see that he refused to answer my points there when I replied (on PING.EXE, SPYBOT SEARCH & DESTROY, & MORE)
He is, afaik, the one that submitted my app to CA as a malware (& it's not intended for that kind of use, I wrote it in good faith for a forums guy that wanted a way to launch OLD Apache server for Windows like a service, invisibly, & since that's only 1-2 lines of code to do? I did!).
CA, now there's a story. Ask Computer Associates about their being caught in a millions of dollars financial/accounting scam, here:
http://www.associatedcontent.com/article/215116/computer_associates_cofounder_led_22.html
Real reputable company, eh?
In fact, I passed every single one of the 21 questions for removal of my ware from their site, & all they ended up doing was lowering it down to a "zero threat level"... but, I'm not too concerned about it, because they also do it to others (along with other Antivirus/Antispyware companies, and we all know how "effective" those are, especially lately vs. today's "blended threats").
Ask Dr. Mark Russinovich of Microsoft or Nir Softer of NIRSOFT if they've ever had their numerous apps libeled along with themselves in the same manner... (answer = they have, so I suppose I am in "good company" here, eh?)
Thor Schrock, lol, another "credible expert" (NOT): That guy doesn't even have a CSC degree or even a single A+ type certification to his name.
All I can say to and about Thor SCHMUCK, is this: GOD BLESS TY TYMKOVICH (LOL, run that by him, it ought to be good for a laugh... the fool got wickedly SUCKERED by him to the tune of $5,500)...
----
JEREMY REIMER??
He got caught by his ISP, Shaw in Canada, for email harassing me as well as impersonating me on his website (along with death threats from he & his pal Jay Little which ended up with a detective Felton in B.C. Canada where Reimer lives taking care of the rest for me).
LOL, Reimer's SO UNQUALIIED, he had to try to bring others, much to his own dismay... especially Fat Jay Little!
Jay Little, who claimed to be an "Exchange Expert" @ Windows IT Pro forums, and when I showed him that MICROSOFT'S OWN DOCUMENTATION PROVED THAT MEMORY OPTIMIZERS COULD RESTART A STALLED EXCHANGE SERVER? Jay Little had to eat his own "self-proclaimed" expert status on Exchange, and left in shame... but, not without stalking me to NTCompatible.com, & getting himself banned there (as he has been at Microsoft's Channel 9 before also for similar stupidities), but also blowing it AGAIN, badly, on ramdisk and their uses plus windows crash dump analysis messages determinations too...
Big comedy & "too, Too, TOO EASY" for me!
This in turn, ended up with death threats from Reimer and Little on their websites, and ended up with CrystalTech.com removing Jay Little's website IN ITS ENTIRETY (forcing him to lol, find another hosting provider) and portions of Reimer's site also being forcibly removed... after Reimer libeled me, made threats to me, and far more.
APK
P.S.=> So much for your "links", because you're only helping me show those 2 as the undereducated & blatantly unqualified FOOLS they are in this art & science! Thank you in fact... Additionally, thank you for showing us all, AGAIN, that slashdot & its cronies like you, are just not THAT GOOD @ picking "experts" (just like this posts use of B. Krebs of the post submitters source, scamdetect, & the editors here doing that blunder VERY UNPROFESSIONALLY in their editing no less)... apk
See subject-line, because it's what starts to kill forums when owners or their moderators begin abusing their viewership or news posters. It's happened before, and can happen again (here too, this place is not by any means unique on that account). When site editors and such begin doing what many others noted here as very unprofessional editorial work, that website usually starts to die or is on the way there already.
http://noscript.net/ for every site you don't explicitly trust
"No one here knows the entire story and making judgement to the otherwise is sad." - by jwl17330536 on Monday April 05, @04:54PM (#31740740)
You've said it yourself, and shot yourself down on the SAME grounds, and were shown in that same type of error here:
http://it.slashdot.org/comments.pl?sid=1664046&cid=32356452
and, here:
http://it.slashdot.org/comments.pl?sid=1664046&cid=32356288
So, thanks for only showing you're obviously yet another one of the types you yourself dislike, and that you're also a hypocrite.
(That's the hilarious part here: You "almighty registered users" here often fail to realize that your own posting histories and words can often be used against you to show you just have your "convenient views and convictions" when they suit you, and that you often 'flip the script' on them, when it suits you also)
APK
P.S.=> Additionally, by your use of the falsehoods you yourself used without your knowing the entire story (though it was there for you to read in Thor SCHMUCK's posting)? You've also helped my case (and I have a winning one per an attorney out of Rochester N.Y., vs. CA & Thor Schrock to the tune of $150,000 U.S. Dollars) you've also shown that others are believing their misleading libel of myself... apk
"No one here knows the entire story and making judgement to the otherwise is sad." - by jwl17330536 on Monday April 05, @04:54PM (#31740740)
You've said it yourself, and shot yourself down on the SAME grounds, and were shown in that same type of error here:
http://it.slashdot.org/comments.pl?sid=1664046&cid=32356452
and, here:
http://it.slashdot.org/comments.pl?sid=1664046&cid=32356288
So, thanks for only showing you're obviously yet another one of the types you yourself dislike, and that you're also a hypocrite.
(That's the hilarious part here: You "almighty registered users" here often fail to realize that your own posting histories and words can often be used against you to show you just have your "convenient views and convictions" when they suit you, and that you often 'flip the script' on them, when it suits you also)
APK
P.S.=> Additionally, by your use of the falsehoods you yourself used without your knowing the entire story (though it was there for you to read in Thor SCHMUCK's posting)? You've also helped my case (and I have a winning one per an attorney out of Rochester N.Y., vs. CA & Thor Schrock to the tune of $150,000 U.S. Dollars) you've also shown that others are believing their misleading libel of myself... apk
My bank has what I consider to be really good security.
My login page just asks for my account number.
Then, the bank proves who it is to me -- by showing me a picture of my choosing and a passphrase of my choosing -- before it asks me for my password.
In other words, before it asks me to give a secret away, it verifies itself with a secret.
As if that weren't good enough, on any browser that I haven't registered, it gives me a challenge question. So, to fake this, even if the scammer managed to get my account name and password, it doesn't have the browser credential, and can't get past the security question; it can't pretend to be my bank because it doesn't know my picture and passphrase (only delivered over SSL), etc.
To clarify: I give my account number. If it is playing MITM, it gets a challenge question, which it can't answer and I know is invalid if it passes it to me; if it wants to bypass that and just ask for my password, it doesn't know what image/phrase to show; it can't play transparent MITM and watch because of SSL security and lack of browser private key credential. That's the best security I've seen so far. Just fails to keylogging software, but that's what a PPC mac is for :-).
A mini-remark: typing stuff on an on-screen keyboard will not help you.
Of course, it depends on the type of keyboard you are using and on the platform, but for instance - Windows' osk.exe (the default one) works by sending WM_KEYUP and WM_KEYDOWN messages to an input window.
A keylogger that uses hooks to watch messages sent to that window will still see the keystrokes.
You can try this hint: http://www.lazybit.com/index.php/a/2007/03/01/free_keylogger_protection It will confuse the person who reads the log, but it makes the data entry procedure much longer and error-prone.
p.s. keystrokes typed inside a virtual machine can also be grabbed, as the host OS "sees" them first, and that's where the keylogger is.
The saddest poem