Re: [Full-disclosure] Firefox Addon: KeyScrambler

[Dan Kaminsky <dan@xxxxxxxxxxx>]

Won't work against a hardware keylogger, as it gets the strokes before the 
driver does.

Won't work against any software aware of it; thread inject into Firefox to get 
the real keystrokes and it's game over.  Or heck, simply pretend to be a 
firefox process to get the decryption key, assuming it's not fixed.

Would work against some stock, mass distributed keyloggers, I suppose?

Sent from my iPhone

On Dec 8, 2010, at 3:12 AM, mrx <mrx@xxxxxxxxxxxxxxxxxxx> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi list,
> 
> Is anyone familiar with the firefox addon KeyScrambler? According to 
> developers this encrypts keystrokes.
> 
> Quote:
> "How KeyScrambler Works:
> When you type on your keyboard, the keys travel along a path within the 
> operating system before it arrives at your browser. Keyloggers plant
> themselves along this path and observe and record your keystrokes. The 
> collected information is then sent to the criminals who will use it to
> steal from you.
> 
> KeyScrambler defeats keyloggers by encrypting your keystrokes at the keyboard 
> driver level, deep within the operating system. When the encrypted
> keystrokes reach your browser, KeyScrambler then decrypts them so you see 
> exactly the keys you've typed. Keyloggers can only record the
> encrypted keys, which are completely indecipherable."
> 
> Can this be trusted? As in trusted I mean not bypassed.
> 
> Input from the professionals on this list would be much appreciated.
> 
> Thank you
> regards
> Dave
> 
> - -- 
> Mankind's systems are white sticks tapping walls.
> Thanks Roy
> http://www.propergander.org.uk
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iQEVAwUBTP9oJrIvn8UFHWSmAQIlVAf/T4zUGOaYiAoM/C+8ZFcMhDuOxOznvyXX
> IROHCr51aoQ6ShEIOhHLoQUaqLzZ4zrGirrnX5LFTJ0nmmr6cAG2raMiAi/BYnQb
> UnoXQkZ+9HnThkTSra59aRe8fRaG/MUlsG4lqWxvb0jGuZf2ekk83MPRlDCeXKWw
> CtMEB7YWRyay1kh6DdTAckXNMWXbfOoLAOh55ldmjhM7IN65EKW1rsQDN8Bdn3aX
> XyWWrRUTXDQfkI4mwXlVcGKuObPt8SAW1MgY8wP5q9qK8nAcGj/cig7URg4cVdYM
> Ss8/tryrPokTTGy2iSGjil3aQn21K5ANm6UYOSoNFodEq2SO0Hwyug==
> =nUTt
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/