For years now I’ve heard discussions regarding security of online password-protected services and, in particular, how to protect yourself when using common use computers, such as those in Internet cafes.
A continual background chorus of folks has had something wrong for years .. use the built in Microsoft On-Screen Keyboard application they say.
This is a dumb idea and has very little, if any value in protecting you … but especially here in the Philippines this seems to have become almost a shibboleth.
I’m tired of wasting my breath with people who fail to grasp how computers and Windows actually work. Perhaps this article will help … safe computing is an issue here in the Philippines, but osk.exe is not the answer..
Prevent keyloggers from grabbing your passwords
By Scott Dunn
Strong passwords are important, but even the best password won’t keep you safe from keyloggers — hardware and software that’s designed to secretly record your keystrokes.
Fortunately, there’s a way you can enter sensitive data so it’s extremely difficult for snoops to extract your passwords from keylogger files.
In her Aug. 6 Top Story, WS contributing editor Becky Waring reported that Google’s Gmail service allows hackers to try to guess your password 1,200 times per day. She provided some useful tips for making strong passwords that are easy to remember but hard to crack.
The bad news? Even the strongest passwords can be recorded by keyloggers. These are software and hardware products designed to capture computer events and store them in a log file.
Keyloggers can have legitimate uses in business, or they can be perverted into collecting passwords for identity theft. For more information on how these products work, see my Oct. 9, 2008 review of free software keyloggers.
Windows’ On-Screen Keyboard app is also logged
If you’re using a computer you aren’t sure is keylogger-free, how do you protect any passwords to sensitive Web accounts you may need to access? A reader named Kenneth recently submitted the following suggestion:
- "I use a simple existing tool in Windows called osk.exe (On-Screen Keyboard). This program, as you may know, resides in the C:\WINDOWS\system32 directory, but there’s no shortcut or link to it, so most people don’t know it exists! You can launch it by entering osk in the Run command.
"Anytime I need to log in to any sensitive sites (banking, etc.), I launch osk.exe first and use this on-screen keyboard to click and enter my user name and password, even on my own home computer. This way, I feel confident that my credentials can never be captured."Kenneth’s suggestion may be useful to prevent some types of hardware keyloggers from detecting signals from the physical keyboard. Unfortunately, the program provides no defense against software keyloggers. Windows’ On-Screen Keyboard sends information to applications as keystrokes, just as though you’d pressed the keys on a keyboard.
The first keylogger program I tested with the OSK workaround — All in One Keylogger from RelyTec — easily captured my keystrokes as I signed in to a Web site. (For more information about the All in One program, see the vendor’s site.)
Popularity: 3% [?]
Recent Comments