验证访问权限时如何避免键盘记录器
正如标题所示，在验证访问权限时，可以采取什么措施来击败按键/击键记录？
我刚刚发布了一个相关问题（how-to-store-and-verify-digits-chosen-at-random-from-a-pin-password）寻求有关从 PIN/密码中选择随机数字的建议。还有哪些其他相当不引人注目的方法？
任何和所有解决方案表示赞赏。
As per the title really, just what can be done to defeat key/keystroke logging when authenticating access?
I have just posted a related question (how-to-store-and-verify-digits-chosen-at-random-from-a-pin-password) asking for advice for choosing random digits from a PIN/password. What other reasonably unobtrusive methods might there be?
Any and all solutions appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
击败键盘记录器的一种解决方案是不关心它们是否捕获您键入的内容。
一次性密码（搜索：“OTP”）是一种解决方案。智能卡身份验证是另一个问题。
One solution to defeat keyloggers is to not care if they capture what you type.
One time passwords (search: "OTP") are one solution. Smartcard authentication is another.
您可以有一个可点击的带有字母的图像。不过你的用户会很生气......
You could have a clickable image with the letters on it. Your users will be pretty mad though...
您可以允许仅使用屏幕键盘输入密码。
或者您可以编写模块（例如在闪存上）用于手写（通过鼠标或 stillus）密码识别。
You can allow to use only on-screen keyboard to enter password.
Or you can write module (on flash for example) for handwriting (via mouse or stillus) passwords recognition.
唯一真正的方法是适当的第二因素身份验证：无论是该人的身份：指纹、虹膜扫描。或者他们拥有的东西：一次性密码列表/生成器；密码生成器。
The only real way is a proper second factor authentication: Either something the person is: fingerprint, iris scan. Or something they have: one-time password list/generator; crypto-generator.
假设仅捕获键盘输入，而不捕获鼠标输入，则您可以通过用鼠标移动光标来乱序输入密码。
不过，我真的更喜欢一次性方法。
Assuming that only keyboard, and not mouse input is captured, you could type the password out of order moving the cursor with the mouse.
I really like the one time approach better, though.
标准密码的变体怎么样？例如，您可以有一个单词列表，并让程序从每个单词中删除随机字母。除此之外，它还会从列表中遗漏一个单词，用户必须记住并输入该单词。
如果这些单词形成一个句子，用户会更容易记住它，但另一方面，创建句子会更困难，因为您需要使用无法从句子上下文中猜测的单词。
另一种变化可能是让程序随机要求用户将所有字母 i 替换为 1 或将 a 替换为 4，或者在每隔三个字母 A 或类似的内容之后放置字母 R。
基本上有一个可以随机修改的密码，并向用户显示如何修改密码的说明。
现在想起来，我不知道我的想法有多么不引人注目……
How about a variation of standard password. For example you could have a list of words and have program leave out random letters from each word. In addition to that it would leave out one word from the list which user would have to remember and type it out.
If the words form a sentence, it would be easier or users to remember it but on the other hand creation of the sentence would be more difficult because you'd need to use words which can't be guessed from sentence's context.
Another variation of this could be to have program at random ask user to replace all letters i with 1 or a with 4 or to place say letter R after every third letter A or something similar.
Basically have a password which would be modified at random and have it instructions displayed to user how to modify the password.
Now that I think of it, I'm not sure how unobtrusive my ideas are...
我银行的网上银行门户有一个很好的方式，我觉得非常不引人注目。创建帐户时，您可以定义 6 位 PIN（除了普通密码之外）。输入密码后，系统会要求您在 2 个随机位置输入 6 位数 PIN 码中的 2 位数字。例如，如果您的 PIN 码是 654321，它会要求您输入数字 2 和 5，然后您将单击 5 和 2（它有一个小键盘，其中包含可供单击的数字）。即使您使用键盘输入数字，它仍然是安全的，因为攻击者不会知道您被要求输入哪些数字（除非他也捕获屏幕，可能使用暴风雨）。
因此，简短的回答是：仅以随机顺序询问密码/PIN 的某些部分。让用户使用鼠标可以提高安全性。
还有一个想法：如果您有 PIN（数字密码），请要求用户修改某些数字，例如“第 2 位数字加 3，第 4 位数字减 1”。
The online banking portal of my bank has a nice way that I find very unobtrusive. When creating the account, you define a 6 digit PIN (additional to a normal password). After entering your password, you're asked for 2 digits of the 6 digit PIN at 2 random positions. For example, if your PIN is 654321, it'll ask your for digits 2 and 5 and you'll click on 5 and 2 (it has a numpad with digits to click on). Even if you'd enter the digits with your keyboard, it would still be kind of safe because the attacker won't know which digits you've been asked for (unless he captures the screen as well, maybe using tempest).
So, short answer: Ask only for some parts of the password/PIN, in random order. Having the user use the mouse increases security.
One more idea: If you have a PIN (numerical password), ask the user for modifications of certain digits, e.g. "2nd digit plus 3, 4th digit minus 1".
基于硬件的键盘记录器不会被任何需要使用键盘的解决方案所愚弄。因此，要绕过这些，您只需要通过鼠标进行输入。但是，可以通过在您自己的代码中添加键盘挂钩来停止基于软件的键盘记录程序，该键盘挂钩捕获按键并且不调用挂钩列表中的下一个挂钩过程。但是，如果使用不正确，键盘挂钩往往会触发防病毒软件，并且如果您在任何参数错误的动态库中使用它们，则会导致错误。
基本上，键盘记录器将使用键盘挂钩来捕获击键。通过在恶意软件 keyhook 之上添加您自己的 keyhook，您将禁用键盘记录器。
但是，有些键盘记录器隐藏在内核深处，因此您很快就会得到一个再次绕过您的安全性的键盘记录器。
不过，不要过分关注键盘记录程序的危险。这只是黑客用来获取各种帐户信息的众多方法之一。更糟糕的是，您无法保护您的用户免受社会工程欺骗。基本上，黑客获取帐户信息的最简单方法就是向受害者询问此信息。通过虚假网站、虚假应用程序和各种其他技巧，他们可以收集您试图通过阻止键盘记录程序来保护的任何信息。但键盘记录程序并不是最大的危险。
一项建议是使用可爱的小猫（或小狗）的图片供用户点击。您可以做的是使用一组 10 张图片，并让用户选择其中的四张作为他们的“pincode”。然后，每当用户需要输入代码时，就以任意随机顺序显示图片，这样黑客就无法知道它的位置。如果它是一个 Web 应用程序，还可以给图片起一个随机名称，并让服务器知道哪个是哪个。为了使其更加复杂，您可以创建 10 组，每组 10 张图片，其中每张图片都显示一个对象，但视角、角度或颜色略有不同。设置 1 是椅子，设置 2 是桌子，设置 3 是小猫，设置 4 是小狗，等等。然后用户只需要记住：桌子、小猫、椅子、小狗。 （或者小狗，椅子，椅子，桌子。或者小猫，小狗，小狗，小狗......）
A hardware-based keylogger will not be fooled by any solution that requires the use of a keyboard. So, to bypass those you will need to have input through the mouse only. But software-based keyloggers can be stopped by adding a keyboard hook in your own code which captures the keys and which does not call the next hook procedure in the hook list. But keyboard hooks tend to trigger antivirus software if used incorrectly and will cause bugs if you use them in any dynamic library with the wrong parameter.
And basically, a keylogger will use a keyhook to capture keystrokes. By adding your own keyhook on top of the malware keyhook, you'll disable the keylogger.
However, there are keyloggers that hide deeper in the kernel so you'd soon end up with a keylogger that will bypass your security again.
Don't focus too much on the danger of keyloggers, though. It's just one of the many methods that hackers use to get all kinds of account information. Worse, there's no way that you can protect your users from social engineering tricks. Basically, the easiest way for hackers to get account information is by just asking their victims for this information. Through fake sites, false applications and all kinds of other tricks they could just collect any information that you're trying to protect by blocking keyloggers. But keyloggers just aren't the biggest dangers.
One suggestion was to use pictures of cute kittens (or puppies) for the user to click on. What you could do is use a set of 10 pictures and let the user pick four of them as their "pincode". Then, whenever the user needs to enter their code, display the pictures in any random order so hackers have no use for it's location. If it's a web application, also give the pictures a random name, and just let the server know which is which. To make it even more complex, you could create 10 sets of 10 pictures, where every picture displays a single object but from a slightly different perspective, different angle or in a different color. Set 1 would be a chair, set 2 a table, set 3 a kitten, set four a puppy, etc. The user then just needs to remember: Table, kitten, chair, puppy. (Or puppy, chair, chair, table. Or kitten, puppy, puppy, puppy...)