Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:19:09 ADT
Simon R Knight (srk@tcp.co.uk)
Sun, 28 Jun 1998 17:10:53 0000
On 28 Jun 98 at 23:33, Peter Gutmann wrote:
> There's no easy way to block this problem. Not only can data be accidentally
> swapped, but it's also fairly easy to grab text from password entry dialogs
> and other controls, even under the supposedly secure NT (there are several
> stealth loggers available which do this). The only way to get around this
> would be for someone to create a custom text control built from scratch which
> works at a very low level and which handles things properly, but that'd be a
> real pain to write. Any volunteers?
>
> [An alternative is to use the method I use with SFS, where a real-mode DOS
> driver reads your password using direct keyboard hardware access before
> Windows can get in the way. This doesn't really work for general Windows
> apps though]
If passwords or passphrases never appear in memory, then they
can't be written to a swapfile, so one solution that I find
presenting itself, is the possibility of hashing of each character as
it is entered at the keyboard. A hash of character one, and a hash of
character two, being hashed together to create a new value which can
then be hashed with a hash of the third character ... and so on. A
display of asterisks (for e.g) could be arranged as a visual
representation for the number of keys pressed.
> >As a more general question, if you (or anyone) knows of any secure Windows
> >controls (or is that an unreconcileable contradiction ), then I would be most
> >interested to learn of them.
>
> Anyone want to write one of these? It'd be a great help to have a secure form
> of the standard text entry control, since the standard Windows ones are
> probably the weakest link in current Windows-based security software. You
> don't need any really fancy features, just something which grabs keyboard
> input and recognises and handles the basic context-switching sequences.
When drivers are available which can *reliably* lock data in RAM,
then developing a more secure range of edit controls sounds like an
interesting project. Can any real security be had while using
Windows character-set/fonts though ?
Is it possible to re-map a font in real-time, so that a given
character can be temporarily mapped to a binary number
generated via a cryptographic process ?
Any suggestions or pointers would be welcome. Thanks.
Simon R Knight
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:19:09 ADT