full-disclosure - Most common keystroke loggers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20051201175536.GB9386@foofus.net>
Date: Thu Dec  1 17:52:48 2005
From: foofus at foofus.net (foofus@...fus.net)
Subject: Most common keystroke loggers?

On Thu, Dec 01, 2005 at 10:24:50AM -0700, Shannon Johnston wrote:
> I'm looking for input on what you all believe the most common keystroke
> loggers are. I've been challenged to write an authentication method (for
> a web site) that can be secure while using a compromised system.

I can think of authentication methods that work (i.e., provide acceptably 
reliable assurance that the user is who he/she claims to be, without 
giving an eavesdropper the means to impersonate the user in future 
authentication transactions) under these conditions.

I can't think of a way of providing any assurance that actions taken in
the user's name are authentic representations of the user's intentions
(i.e., a way of ensuring that requests made on the user's behalf are
legitimate) if the user's system is compromised.  Is that part of the
challenge?  

--Foofus.