Vista - a dumb question: on-screen keyboard...

09-13-2007

would using an onscreen keyboard to type in passwords when on a wifi
hotspot avoid capture by keylogging programs? reason i ask, i was just
reading a Norton email about password security and they mentioned that
one shouldn't log in to a bank site when on those hotspots due to
possible key loggers.

Dave

09-13-2007

oh, and my ING account sign in page has an onscreen keypad for entering
log in info, ostensibly to avoid keyloggers, I believe...

Dave

09-13-2007

Keyloggers run on individual machines, not on entire hotspots. The session
between a workstation and the bank's web server is protected with SSL. So if
someone were sniffing traffic from the hotspot, your password would be
protected. However, if you were using some kiosk computer (rather than your
own), then it is possible that keylogging software on that machine could
intercept your password before it gets passed to the SSL encryption. I never
worry about hotspots, because I always use only my own laptop. I do, though,
worry a bit about kiosks.

Onscreen keyboards really don't help here. Sure, they can thwart keyloggers,
but what about screen recorders? What about rootkits or trojans (again,
installed on a kiosk) that can hijack a session after login happens? Public
machines simply present too many risks.

--
Steve Riley
steve.riley@xxxxxx
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com

"David" <david@xxxxxx> wrote in message
news:57WdnX9LFOxh3HTbnZ2dnUVZ_hKdnZ2d@xxxxxx

Quote:

> would using an onscreen keyboard to type in passwords when on a wifi
> hotspot avoid capture by keylogging programs? reason i ask, i was just
> reading a Norton email about password security and they mentioned that one
> shouldn't log in to a bank site when on those hotspots due to possible key
> loggers.
>
> Dave

09-13-2007

Steve Riley [MSFT] wrote:

Quote:

> Keyloggers run on individual machines, not on entire hotspots. The
> session between a workstation and the bank's web server is protected
> with SSL. So if someone were sniffing traffic from the hotspot, your
> password would be protected. However, if you were using some kiosk
> computer (rather than your own), then it is possible that keylogging
> software on that machine could intercept your password before it gets
> passed to the SSL encryption. I never worry about hotspots, because I
> always use only my own laptop. I do, though, worry a bit about kiosks.
>
> Onscreen keyboards really don't help here. Sure, they can thwart
> keyloggers, but what about screen recorders? What about rootkits or
> trojans (again, installed on a kiosk) that can hijack a session after
> login happens? Public machines simply present too many risks.
>

thanks for the info, Steve! very helpful!

Dave

09-13-2007	#1 (permalink)
David n/a posts	a dumb question: on-screen keyboard... would using an onscreen keyboard to type in passwords when on a wifi hotspot avoid capture by keylogging programs? reason i ask, i was just reading a Norton email about password security and they mentioned that one shouldn't log in to a bank site when on those hotspots due to possible key loggers. Dave
My System Specs

09-13-2007	#2 (permalink)
David n/a posts	Re: a dumb question: on-screen keyboard... oh, and my ING account sign in page has an onscreen keypad for entering log in info, ostensibly to avoid keyloggers, I believe... Dave
My System Specs

09-13-2007	#3 (permalink)
Steve Riley [MSFT] n/a posts	Re: a dumb question: on-screen keyboard... Keyloggers run on individual machines, not on entire hotspots. The session between a workstation and the bank's web server is protected with SSL. So if someone were sniffing traffic from the hotspot, your password would be protected. However, if you were using some kiosk computer (rather than your own), then it is possible that keylogging software on that machine could intercept your password before it gets passed to the SSL encryption. I never worry about hotspots, because I always use only my own laptop. I do, though, worry a bit about kiosks. Onscreen keyboards really don't help here. Sure, they can thwart keyloggers, but what about screen recorders? What about rootkits or trojans (again, installed on a kiosk) that can hijack a session after login happens? Public machines simply present too many risks. -- Steve Riley steve.riley@xxxxxx http://blogs.technet.com/steriley http://www.protectyourwindowsnetwork.com "David" <david@xxxxxx> wrote in message news:57WdnX9LFOxh3HTbnZ2dnUVZ_hKdnZ2d@xxxxxx Quote: > would using an onscreen keyboard to type in passwords when on a wifi > hotspot avoid capture by keylogging programs? reason i ask, i was just > reading a Norton email about password security and they mentioned that one > shouldn't log in to a bank site when on those hotspots due to possible key > loggers. > > Dave
My System Specs

09-13-2007	#4 (permalink)
David n/a posts	Re: a dumb question: on-screen keyboard... Steve Riley [MSFT] wrote: Quote: > Keyloggers run on individual machines, not on entire hotspots. The > session between a workstation and the bank's web server is protected > with SSL. So if someone were sniffing traffic from the hotspot, your > password would be protected. However, if you were using some kiosk > computer (rather than your own), then it is possible that keylogging > software on that machine could intercept your password before it gets > passed to the SSL encryption. I never worry about hotspots, because I > always use only my own laptop. I do, though, worry a bit about kiosks. > > Onscreen keyboards really don't help here. Sure, they can thwart > keyloggers, but what about screen recorders? What about rootkits or > trojans (again, installed on a kiosk) that can hijack a session after > login happens? Public machines simply present too many risks. > thanks for the info, Steve! very helpful! Dave
My System Specs

Similar Threads
Thread	Forum
Dumb question of the day	VB Script
WPF - Possible Dumb Question	.NET General
Probably a dumb question but...	.NET General
Dumb Question 3	Vista General
Dumb question...RC2	Vista installation & setup