[Ext In Prog.] OnScreen Keyboard [Security]

interesting

I can see how it would prevent keyloggers from working, but isn't having a keyboard on the screen less secure in terms of allowing other people to see what you type? Also, if someone has a keylogger on your computer, why can't they monitor network traffic as well?

The reason I brought it up was that you said:
"This will also make it more secure to login on an internet cafe without setting your account security on a high risk"
My point was that it doesn't, necessarily, it just shifts where the issue is.

I suppose, although you could use Javascript to encrypt the password and lock the cookie to one IP address. Then you would be more secure (although your solution might not always work).

Personally, I happen to disagree: I think it gives the user a false sense of security.

http://en.wikipedia.org/wiki/Keystroke_ … _keyboards

Well, it's a work in progress. It might be different from now. thanks to you guys

Next time Thanks tho

I think it is like putting a lock on a door ... a good idea! But locks don't stop everyone.

A lock is better than nothing, yes?

I know, but thats how I was reading it

You are then vulnerable to a replay attack (someone sends the request again). The way to deal with that is to hash the password along with the current time, pass the current timestamp, and let the server validate it based on that (and disallow any times more than, say, 5 minutes off).

No, the second case does not allow for a replay attack. However, it still does allow for someone to steal the cookie. But as I said before, it is possible to "lock" the cookie to one IP, which would limit the ability of the person to use the cookie.

It would exclude anyone whose IP address changes within a session. I don't work with TOR, but if each request comes from a different exit node, then yes.