6

Is it possible and make sense to integrate anti-keylogger directly into monero wallet, so keyloggers can't read and steal seed/password?

  • Keyloggers can still steal this things if you are using a computer with them; they just need to avoid detection. – PyRulez Sep 8 '16 at 2:21
9

No. A keylogger can run on your keyboard's firmware, or in your computer's BIOS, or as a rootkit. In fact, a sophisticated attacker doesn't even need to drop a keylogger on your computer, they just need a device that is within range of your wifi network and they can detect your keypresses based on how they interfere with the wifi signal.

The answer is not to try defeat keyloggers, it's to use some form of 2FA, which in cryptocurrencies normally comes in the form of a hardware wallet such as Trezor, Ledger, or Keepkey.

  • you could present the user with a random generated code where the alphabet would be mapped to a random permutation of it and have the user type only the first 3 letters using the scheme displayed. this is just one idea - so can't agree with your straight "No." :) – JollyMort Sep 10 '16 at 11:12
  • 1
    @JollyMort even a rudimentary keylogger can scrape the screen at the same time, so I don't think adding a frustrating user experience is worthwhile. It might solve certain classes of attacks, such as the wifi interference stuff I linked to, but again - an attacker can film your screen from a distance or through a window. – fluffyponyza Sep 10 '16 at 14:42
  • 1
    Good point. As it has been said above, we're not designing anti-malware here. – JollyMort Sep 10 '16 at 15:51
  • Worth reading about Tempest. It is possible to register every hard wired key depression from a computer merely by analyzing electromagnetic emanations. Short of applying Faraday Cages or related technologies, making key or screen time variant is a means to defeat signal analysis. – skaht Sep 11 '16 at 0:16
3
  1. It would be possible to include binaries for a anti-keylogger or anti-malware program

  2. This would be a huge waster of time for Monero developers. Monero is a crypto-currency not a anti-malware company. There is no shortage of other sources for anti-malware software that are of high quality and likely to updated more often that what Monero developers could provide.

3

Two factor hardware devices such as Trezor, Keepkey, and Ledger have keylogger countermeasures. Experimental Trezor software exist for the simplewallet.

See:

  1. http://weuse.cash/2016/03/07/trezor-for-monero-first-impressions/
  2. https://forum.getmonero.org/4/academic-and-technical/2495/experimental-trezor-firmware-testing
  3. https://github.com/NoodleDoodleNoodleDoodleNoodleDoodleNoo/monero
  4. https://www.youtube.com/watch?v=9JiW1ioxm4c

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.