From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7fXnaizBee8b for ; Tue, 4 Oct 2011 23:43:07 +0200 (CEST) Received: from lo.gmane.org (lo.gmane.org [80.91.229.12]) by mail.saout.de (Postfix) with ESMTP for ; Tue, 4 Oct 2011 23:43:06 +0200 (CEST) Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1RBClR-0003Ns-5I for dm-crypt@saout.de; Tue, 04 Oct 2011 23:43:01 +0200 Received: from cable-87-78-195-145.netcologne.de ([87.78.195.145]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 04 Oct 2011 23:43:01 +0200 Received: from takethebus by cable-87-78-195-145.netcologne.de with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 04 Oct 2011 23:43:01 +0200 From: Jan Date: Tue, 4 Oct 2011 21:42:45 +0000 (UTC) Message-ID: References: <20100412171540.GA3138@tansi.org> <20100412175856.GA12353@fancy-poultry.org> <20100413154850.GA19142@tansi.org> <20100413193831.GA8772@fancy-poultry.org> <4BC4CC14.6080408@redhat.com> <20100414153050.GA3966@tansi.org> <4BC60CB2.8030902@gmail.com> <20100414233054.GC9776@tansi.org> <20111004182800.GA16389@tansi.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [dm-crypt] avoid keyloggers: enter password with mouse?(virtual?keyboard) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Arno Wagner writes: > On Tue, Oct 04, 2011 at 03:02:55PM +0000, Jan wrote: > > Arno Wagner writes: > Other than that, I think this would be a neat add-on, but not a > cryptsetup core project. Something like zuluCrypt (but easier > to do) > > Side note: We might think about adding a link-list for > such projects. Whom could I encourage to realize such a project? > Side note 3: All this only helps to a limited degree. A PC > with keylogger might just also have a video-grabber (or > cheap HD camera) pointed at the screen. Heinz Diehl writes: > Privacy on a machine outside of your control is a no-go. > There are by far more options to get access to your data if > somebody other than yourself has admin/root access to the machine > you're using. A simple script which does a copy of anything inserted > will do it. Or the admin himself logged in from another machine, and > many more... Tools like privatix (see http://www.mandalka.name/privatix/index.html.en ) are designed for MOBILE use to make internet cafes a SAFER place. This does not mean such systems offer perfect security. Booting your own OS safes you from "software attacks" like the ones Heinz Diehl mentioned (is this right?). Thus the "only" remaining thread comes from the hardware side. It seems to me the most COMMON thread there are hardware keyloggers. I thinks hardware based video-grabbers are not that common (what do you think?). They need a lot of disk space, don't they? In my scenario the attacker would need a hardware video-grabbers AND a hardware keylogger, I think this should be unlikely in common internet cafes, while a keyloger alone is likely. HD camera pointed at the screen don't seem such a threat to me since in internet cafes you can often turn the screen or move your body close to it, so its content is hard to see for others. My point is I want to be protected agains the likely threads, not the unlikely. If I have very very sensitive data, I agree, that using an internet cafe is no good. Originally I was looking for a rather safe way to use my gnuPG-key in internet cafes or foreign computers.