Is it possible and make sense to integrate anti-keylogger directly into monero wallet, so keyloggers can't read and steal seed/password?
1
-
Keyloggers can still steal this things if you are using a computer with them; they just need to avoid detection.– Christopher KingCommented Sep 8, 2016 at 2:21
Add a comment
|
3 Answers
No. A keylogger can run on your keyboard's firmware, or in your computer's BIOS, or as a rootkit. In fact, a sophisticated attacker doesn't even need to drop a keylogger on your computer, they just need a device that is within range of your wifi network and they can detect your keypresses based on how they interfere with the wifi signal.
The answer is not to try defeat keyloggers, it's to use some form of 2FA, which in cryptocurrencies normally comes in the form of a hardware wallet such as Trezor, Ledger, or Keepkey.
-
you could present the user with a random generated code where the alphabet would be mapped to a random permutation of it and have the user type only the first 3 letters using the scheme displayed. this is just one idea - so can't agree with your straight "No." :) Commented Sep 10, 2016 at 11:12
-
1@JollyMort even a rudimentary keylogger can scrape the screen at the same time, so I don't think adding a frustrating user experience is worthwhile. It might solve certain classes of attacks, such as the wifi interference stuff I linked to, but again - an attacker can film your screen from a distance or through a window. Commented Sep 10, 2016 at 14:42
-
1Good point. As it has been said above, we're not designing anti-malware here. Commented Sep 10, 2016 at 15:51
-
Worth reading about Tempest. It is possible to register every hard wired key depression from a computer merely by analyzing electromagnetic emanations. Short of applying Faraday Cages or related technologies, making key or screen time variant is a means to defeat signal analysis.– skahtCommented Sep 11, 2016 at 0:16
It would be possible to include binaries for a anti-keylogger or anti-malware program
This would be a huge waster of time for Monero developers. Monero is a crypto-currency not a anti-malware company. There is no shortage of other sources for anti-malware software that are of high quality and likely to updated more often that what Monero developers could provide.
Two factor hardware devices such as Trezor, Keepkey, and Ledger have keylogger countermeasures. Experimental Trezor software exist for the simplewallet.
See:
