From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9GyZS0IZVDAN for ; Wed, 30 Nov 2011 16:11:25 +0100 (CET) Received: from mail-qw0-f43.google.com (mail-qw0-f43.google.com [209.85.216.43]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mail.saout.de (Postfix) with ESMTPS for ; Wed, 30 Nov 2011 16:11:25 +0100 (CET) Received: by qadz3 with SMTP id z3so2929242qad.16 for ; Wed, 30 Nov 2011 07:11:24 -0800 (PST) MIME-Version: 1.0 In-Reply-To: <20111130144647.GA4918@tansi.org> References: <20100413154850.GA19142@tansi.org> <20100413193831.GA8772@fancy-poultry.org> <4BC4CC14.6080408@redhat.com> <20100414153050.GA3966@tansi.org> <4BC60CB2.8030902@gmail.com> <20100414233054.GC9776@tansi.org> <20111004184809.GB3071@fancy-poultry.org> <20111130144647.GA4918@tansi.org> Date: Wed, 30 Nov 2011 16:11:24 +0100 Message-ID: From: Ma Begaj Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [dm-crypt] avoid keyloggers: enter password with mouse?(virtual?keyboard) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de 2011/11/30 Arno Wagner : > On Wed, Nov 30, 2011 at 03:22:50PM +0100, Ma Begaj wrote: >> 2011/10/4 Heinz Diehl : >> > On 04.10.2011, Jan wrote: >> > >> >> You have a fully encrypted system on your USB stick like privatix >> >> (see http://www.mandalka.name/privatix/index.html.en ) and you are >> >> sitting in an internet cafe. There's a hardware keylogger installed >> >> on that the PC you use. You lose your USB stick, maybe you even >> >> forget it in the internet cafe (this happens)! >> > [.....] >> > >> > Privacy on a machine outside of your control is a no-go. >> > There are by far more options to get access to your data if >> > somebody other than yourself has admin/root access to the machine >> > you're using. A simple script which does a copy of anything inserted >> > will do it. Or the admin himself logged in from another machine, and >> > many more... >> >> >> that is not true. two factor authorization solves this problem pretty easy. > > It seems to until you look more closely. Current attacks > on online-banking demonstrate the attack. The only way around > that is basically to delegate all interaction to a device > the attacker did not have access to. Everything else just > increases attackert effort, but is still feasible. > >> I am using barada on my machines for SSH and it is working pretty great. >> http://barada.sourceforge.net/ > > What has "working well" to do with "being secure"? Not a lot, I > would say. If the machine you do this one has been pepared > to hijack ssh-sessions, it can easily look over all your stuff > without you ever knowing and install a backdoor on the machine > you logged in to. This is a practical attack, even if it causes > some effort on the attacker's side. there is no absolute security on other people's machine but two factor authentication is a secure solution against keylogger attacks and I was pointing to that.