up vote 8 down vote favorite
share [g+] share [fb]

Suppose that I have access to a computer (say, running OSX, so that we have BSD tools available) on which I have an admin-privileged account (full superuser rights), but that the owner of the computer has, for contractual/legal reasons, installed some kind of security program that can log keystrokes and probably other spyware-type things. As a matter of the computer owner's policy, I'm allowed to use the computer for some personal activity, but I am not permitted to disable or circumvent the security software. (edit: Booting the computer to a state without the security software running is not permitted. I am also not permitted to use my own computer.)

What ways are there for me to access my personal accounts of various types (general email, Google accounts including Google Music, Pandora, servers via SSH, etc.) without exposing the accounts to potential compromise from the information logged by the security software?

One possibility that has occurred to me is that logging in to a service that used 2- or 3-factor authentication might be safe, especially if some of the factors were out-of-band. For instance, if I logged in to an OpenID provider such as MyOpenID by using a username, password, and CallVerifID/PhoneFactor, my username and password would be captured by the security software, but the account could not be accessed without the something-I-have factor of my phone, used entirely out-of-band. (I think similar reasoning would hold for an OpenID provider using a one-time-password token such as a Yubikey, even though the OTP isn't sent out-of-band.) I would then think that any site I then logged into using that OpenID account would still be secured. Am I right about this?

link|improve this question
2  
Get a smartphone and use it for "personal" stuff? It's not your own "computer". Depending on the terms, might be the only way to "safetly" access your own info... but on the flip side... if neither side trusts each other, is this a good place to work? They don't trust you (Key loggers)... you don't trust someone keylogging you (Uh... duh). Not a healthy environment. – WernerCD Aug 14 '11 at 21:44
1  
So I'm guessing this computer is at work. How about just working instead of trying to figure out how to circumvent the system to not work. – murisonc Aug 14 '11 at 22:33
1  
Most people don't spend all 8 hours a day working. An occasional break can be very helpful and can even make you more productive during the hours you are actually working. – Jonathan Sternberg Aug 14 '11 at 22:53
1  
I agree people don't work 8 hours; no one does. Taking a break from the computer can be very helpful; not checking personal e-mail. Sorry, but try working in an environment where you physically don't have access to the Internet. – murisonc Aug 14 '11 at 22:59
1  
@jprete: In practice, I'm not as much worried about the people collecting the data, but about the potential lack of security around the collected data, so I'm less concerned with attacks that would have to happen concurrently, like session hijacking. I already asked a narrower version of this question on security.SE, having discovered that SE site and having read several of the answers here and realized that I was really looking for something more specific. – Isaac Aug 15 '11 at 1:34
show 5 more comments
feedback

closed as too localized by Linker3000, akira, Diago Aug 16 '11 at 9:36

This question is unlikely to ever help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. See the FAQ for guidance on how to improve it.

8 Answers

up vote 5 down vote accepted

Reading the other answers, and giving it a bit of though after my comment... I would think the best options, imo...

A) a Smartphone that you can use for personal things...

B) a Remote Desktop or VNC into a "safe computer".

This would have passwords and credentials "saved". (Combination of Keltari's answer and D.Lankovs answer.) This would not involve any "typing" of information on the "logged" computer (Some keyloggers can watch the copy/paste logs. I've also heard of loggers taking screenshots as well to bypass onscreen keyboards.) I wouldn't trust any "input" in a logged machine. Physical Keyboard, onscreen, password programs...

About the only thing worth worrying about is the logon credentials TO the remote machine. You could setup changing passwords, timed access (only during "business" hours), access restrictions (only for a certain MAC/IP address), monitoring of your own to/from that computer...

link|improve this answer
If you remote into another machine from a machine that's being keylogged, EVERYTHING you type to the remote machine will still be logged, assuming the keylogger does what it's supposed to do. – Lee Nov 2 '11 at 0:40
feedback
up vote 6 down vote

remote desktop to another machine and use a virtual keyboard on that machine. Since no keys are pressed on the host machine, they wont be logged.

link|improve this answer
1  
... but the login to the remote machine would be compromised, wouldn't it? – Isaac Aug 14 '11 at 21:16
3  
Nope. in windows the virtual keyboard can be available at the login screen. Wouldnt be much use to a disable person if this want the case. – Keltari Aug 14 '11 at 21:28
Many "key"loggers also log mouse movements, periodic screen snapshots, etc. Remote desktop and keylogging are basically completely separate subjects; using a remote desktop will not affect any serious keylogger, in any way. – Lee Apr 6 at 13:08
feedback
up vote 4 down vote

Boot from a Live CD and/or external HD / flash drive. Nothing else is really trustworthy.

You would be much better off just getting your own computer, and refusing to use one that logs your keystrokes when you access personal accounts (assuming you're actually authorised to access personal accounts at work or whatever).

link|improve this answer
Unfortunately, booting to a state without the security software isn't allowed, nor is using my own computer. – Isaac Aug 14 '11 at 20:04
just wanted to recommend the same :-) I thought about the case as some school used the laptops of their students to spy them. In such case I think I would also use my own linux live cd to get enough privacy. – Juhele Aug 14 '11 at 20:07
@Isaac Why not, exactly? Under whose terms are you using this system? – new123456 Aug 14 '11 at 20:45
1  
@new123456, most likely his employer’s. – Synetech Aug 14 '11 at 20:55
@new123456: Hypothetically, let's say this is a workplace policy, so violating it would mean loss of employment. – Isaac Aug 14 '11 at 21:17
show 1 more comment
feedback
up vote 2 down vote

Without knowing the exact nature of the keylogger, its hard to tell.

In such a situation though, I'd probably have a duplicate set of accounts for Google and Pandora, and use disposable, passwordless logon accounts for said servers.

In short, rather than attempting to secure your accounts, make it so that actual compromise has no 'cost' for you.

On top of this, you can use the other methods that have been mentioned.

link|improve this answer
feedback
up vote 1 down vote

There is not a safe method. This is a sticky situation.

Here is what I would do.

Prepare on normal computer a Mozilla profile with all your important passwords etc saved and secure master password. Preferably phrase from a free book/short story available online.

After that copy paste it on this pc.

Then whenever you need to do is when some site asks for your password - mozilla will auto complete. On first time every session it will ask you for your master password - open your story, select pass phrase and copy/paste. the only thing a keylogger sees is ctrl+c and ctrl+v. Just for the fun of it you can use ditto or something like that. so it will be deeply buried in the queue.

Not sure how to deal with clipboard monitoring though.

link|improve this answer
That’s what I suggested, but you don’t need to copy-paste if the browser has the login data stored; it can auto-complete with the drop-down. – Synetech Aug 14 '11 at 20:57
@Syn: The copy-paste is to handle the password that encrypts the auto-complete database, I think. – Isaac Aug 14 '11 at 21:15
From the original question, it sounds like the employer looking at files on the disk isn’t the concern, so a master-password may not be necessary. Of course, it all depends on what browser he’s using, so… – Synetech Aug 14 '11 at 21:20
feedback
up vote 1 down vote

Try to use an onscreen keyboard when you enter your usernames and passwords. It's found in the accessibility section unless the owner got rid of it somehow.

Enabling it on Macs: http://gigaom.com/apple/mac-101-get-an-onscreen-keyboard-in-osx/

Winodws: Start > All Programs > Accessories > Accessibility (Ease of Access on Windows 7) > On Screen Keyboard

link|improve this answer
He’s running OSX, not Windows. – Synetech Aug 14 '11 at 20:56
It's up there above Windows with the link if you didn't see it – Alex Yan Aug 14 '11 at 21:00
Right.​​​​​​​​​ – Synetech Aug 14 '11 at 21:06
feedback
up vote 1 down vote

You could look for anti-keylogging software, which may or may not violate your TOU depending on how it works.

One method that is frequently used for this sort of thing is to use the mouse to input the data (usernames, passwords, etc.) instead of the keyboard with a virtual keyboard. You can the standard OSK (Onscreen-Keyboard) that comes with Mac or Windows, or third-party tools. Even with a mouse-logger, there isn’t really any way to determine which keys are being sent to the page since the position of the mouse is relative to the window, and the position of the window can be anywhere.

Of course, depending on the method that the OSK uses to send the keys to the page, the key logger may still be able to intercept them. As a result, there are browser addons and extensions that provide an OSK that becomes part of the browser and sends them via JavaScript, thus bypassing the keylogger.

In conjunction with the OSK, storing your account login information (either via the browser or an extension/addon) is (possibly counterintuitively) helpful for this situation since after the initial login, you don’t have to log in again, or at least, you don’t have to type them in again because they are stored as part of the browser’s autocomplete data.

link|improve this answer
just an idea - is there anything like portable Virtualbox or something else with secured controls which could prevent keylogging? I could imagine something on windows but have no experience with OSX. – Juhele Aug 14 '11 at 20:10
Wouldn’t booting a guest OS (which has no monitor software) in effect, but a violation like booting a host OS without the logger? If not, then I suppose you found a loop-hole (at least until they add that to the policy). – Synetech Aug 14 '11 at 20:30
feedback
up vote 0 down vote

Well, A quite simple one , type the password in random orders while using the mouse to change the order, for example if your pwd is apple

type p, move the cursor to start

type a, move the cursor to end

type e, move the cursor to ......

link|improve this answer
1  
obfuscation is not security. If someone was monitoring the logs, they would see all the keys pressed in the password. It wouldnt take long to figure out the password. – Keltari Aug 15 '11 at 6:22
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.