2

Password managers arguably provide greater security since it allows users to easily create unique, difficult-to-guess passwords for every website they log in to.

But, if someone has a keylogger on their computer, isn't all this security defeated as soon as the user inputs their master password to get into the password manager?

Even if the user implements one-time passwords or two-factor authentication, the password manager still inserts the password of your saved websites in when you log into them (e.g. auto-type in KeePass).

From this, it seems that if you have a keylogger on your computer, you're totally screwed when it comes to passwords...

Or are you?

Improve this question
3
  • 3
    In most cases, at least with the browser implemented solutions, the way the password is transferred into the password field within the browser is very difficult to intercept. Like all things when it comes to security if your system is already infected most security precautions are not actually useful. Password managers are solving an entirely different set of problems, preventing your password from being stolen by malware on the machine it resides on, isn't one of them.
    – Ramhound
    Jan 16, 2015 at 20:10
  • A keylogger, by itself, cannot read the password database. However, if there is any malware on the machine, the database may very well be compromised by some other means.
    – bwDraco
    Jan 16, 2015 at 21:43
  • As many answers explain (and I have no clue about why they've been downvoted), it doesn't. So I think that the correct question is whether it's reasonably secure to use a password manager or write your passwords on a piece of paper (not stored in the same place as your phone). I wonder whether there are studies of which is riskier/safer.
    – Antonis Christofides
    Sep 9, 2020 at 17:03

6 Answers 6

Reset to default
1

As pointed out by @G-Man correctly in the comment.

The malware has still to upload the password database. I'm talking about KeePass and derivatives, which store passwords on your PC. If you have a cloud password manager a keylogger may detect that you are typing www.lastpass.com on your browser, or simply upload data to the malware's owner to guess which cloud service you use.

In general, a computer infected by malware is to be considered as totally violated unless contrary proven. An advanced keylogger might also capture clipboard contents, screen state, etc. You can never prove you have been attacked by a kid's toy or by a complex work of engineering

Improve this answer
0

Use virtual keyboards that's can't be detected by keyloggers link

https://www.raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity/

https://www.geckoandfly.com/2609/free-keylogger-to-monitor-keystrokes-recover-hotmail-yahoo-mail-gmail-password/

On screen keyboards can be recorded by keyloggers

Improve this answer
0

To answer the question in the title, it doesn't. An attacker can read your master password using the keylogger so even if the password management tool transfers your passwords into the fields in a way the keylogger can't intercept, you're screwed anyway. A machine with malware running on it should be considered totally compromised and never used for anything where security is even a vague concern. Format the hard drives and start again.

2FA with a one time password will help you in the time between a keylogger being installed and you discovering it and dealing with it though, which is one of the many reasons you absolutely should use it everywhere it is available. The reason this works is that a password in a OTP system can never be used twice, so finding out what it is achieves nothing.

Improve this answer
-2

Not necessarily. if you would have keylogger, the attacker would get the "master" password to the keylogger system, which in itself might be bad, but base on which one you are using they would have to manually try to see if you have online sync setup and you may not, which means that you are protected

So for example I use RoboForm - only the desktop version with no online sync.

You ptu key logger on my system, you are goign to get my Passw0rd! for RoboForm but the transfer of my password for www.chase.com between the browser and RoboForm is still secure. So you can try to guess my email at www.roboform.com and see if I do onlien sync but you will fail....

Thus I am still protected

Improve this answer
2
  • 1
    But, if the attacker has enough access to your computer to install the keylogger, he has enough access to read your password manager's encrypted files, so he can use your master password to decrypt the others. Even if he can't access the passwords in the clear, he can clone your entire machine and then login to your accounts (bank, email, etc.) and do whatever damage he wants.
    – G-Man Says 'Reinstate Monica'
    Jan 16, 2015 at 20:26
  • It depends how the keylogger was installed - to clone the whole machine takes hours, in most cases I see the keyloggers get installed either remotely thus entire copy is not feasible or locally with some quick action like inserting USB key, executing and removing (insider attack)
    – TomEus
    Jan 16, 2015 at 22:39
-3

Yes, a keylogger can intercept anything typed, which is why high-security apps use the on-screen keyboard, which uses the mouse, touch-pad or touch interface.

Improve this answer
-3

Some password managers give also protection against keyloggers for instance using keyboard encryption when typing the master password. I don't personaly favor visual keyboard, since keyloggers car take hidden screen prints at a rather high frequency.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .