14

A quick question: I use on-screen keyboard when entering my bank passwords, credit card numbers, etc., in an effort to guard against malware. Is this a good idea or am I wasting my time? Some internet banking website have an on-screen keyboard for entering in a password are these any more secure?

6 Answers 6

11

The built-in on-screen keyboard that comes with many operating systems is designed to help people who are unable to use a physical keyboard because of disabilities. Due to this, an on-screen keyboard behaves as much like a real keyboard as possible and it's activity will most likely be logged by a keylogger.

On-screen keyboards specifically designed for security (on a bank's website, for example) are a different story and are likely more secure against keyloggers.

http://www.viruslist.com/en/analysis?pubid=204791931

1
  • Thank you, I had an inkling but I wasn't sure but “More important than the quest for certainty is the quest for clarity” Commented Aug 27, 2009 at 2:12
7

On-screen keyboards prevent a keyboard dongle from recording your keystrokes. There are other methods for recording keystrokes an on-screen keyboard will not prevent, though.

1
  • The bank ones that I've seen tend to move the keyboard button position around a bit on each login so the relative mouse position changes, making it hard to know what buttons a user clicked on. Commented Dec 18, 2009 at 5:40
1

Using an on-screen keyboard would make your password readable by people with no connection to your computer. :D

http://en.wikipedia.org/wiki/Van_Eck_phreaking

http://en.wikipedia.org/wiki/TEMPEST#Public_research

0

Note that an OSK is not secured against things that also track mouse movements, though figuring out what you clicked is much harder. I like to keep parts of my password in autohotkey hotstrings. (because "password" is so much easier to work out than "p66j#wokk#d")

1
  • 1
    If your OSK changes its layout every few characters--which is annoying, mouse movements become harder to track--now images of the screen have to be saved too.
    – Broam
    Commented Dec 11, 2009 at 16:40
0

Spyware can detect mouse movements, allowing to calculate which buttons were clicked and even take screenshots on mouse release. Not sure if standard keyboard that goes preinstalled with Windows protects against this.

However, there is a number of so called anti-keylogger on screen keyboards that claim to provide protection against such attacks. I am not providing names here but you can google them. Some people even test and compare them, laying out results on the web.

The question is how trustworthy such analysis is. The best way would be to test them yourself, for that you would have to install such a keyboard on a testing machine along with a keylogger and see how it goes.

PS: An interesting comparison is here: https://www.raymond.cc/blog/how-to-beat-keyloggers-to-protect-your-identity/

0

The best solution to beating keyloggers I can think of is this: use a cloud computing virtual machine and within that virtual machine use a password manager to autofill passwords. since the password is never displayed, screen monitoring from the host computer won't do anything and the keylogger won't be on the virtual machine itself to log traffic there and since you're using a password manager on the virtual machine, no keystrokes or mouse patterns from activating the password manager will reveal anything useful to the key logger on your computer. furthermore, all data going to and from the cloud virtual machine is encrypted with a VPN, and any data concerning the password won't be sent to your computer other than the black dots obscuring the password. provided you never download anything other than what is absolutely necessary for the virtual machine's security and what important/sensitive things you need to use it for, you shouldn't ever get malware of any kind on the virtual machine. I don't think even a hardware based keylogger on the host computer can log that. you'd basically be immune to key logging.

1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Sep 27, 2023 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .