Dual layer login to resist keyloggers

Yes its keylogger resistant, like some things are water resistant. Not proof against the malware.

Your idea would only protect against actual keyloggers but what happens next, the person attempting to steal your credentials has to now only guess your visual “password” which of necessity has to be less complex than a traditional password. They could automate the cracking and get in real quick.

BUT this does not stop the later keyloggers which includes screen shots and mouse movements. These (now old) keyloggers will collect your visual “password” just as easily.

In effect all you have done is eliminate the threat from one type of malware and given a sense of security to the user.

You need to incorporate a challenge-response that cannot be copied. Ideally this would be from a device that is separate from your device that is logging onto the SAFE network. even a OTP like Poloniex’s 2FA would be far better than the visual “password”. But something along the lines of RFC Possibility SQRL - #14 by dirvine adapted for this purpose would be superior.

Maybe for those in Australia &/or NSW where NSW Police or ASIO can now legally enter your house in secret and plant malware on your computer install spy cameras around your house etc. We can have say a USB connected device that receives the challenge and responds from/to the group.

The challenge/response removes the requirement for a password and because it is encrypted and each challenge is used once only the attacker could record everything and never be able to reuse it. Your account is safe as long as you never reveal the challenge/response device’s key.

2 Likes