Where have your screen keyboard posts gone, etotheipi? Anyway here is an idea, how about the kind of trick implemented by banks: produce an encrypted wallet and a list of symbols using a passphrase, print out the list in paper, each time when the user wants to access the wallet, he is prompted to pick a certain series of symbols from the paper, what do you think?
What do you mean? It's one page back:
https://bt.irlbtc.com/view/56424.msg1761230#msg1761230As for your idea: I think there's some good ideas out there, but I think they're not much benefit over the existing version. Yes, you can make it harder it for someone to share their passphrase if you use symbols, or textures, etc. But I don't think it's worth the effort. With my limited time, I have to pick and choose my battles wisely, and I don't think that one is one I want to battle
Well, what I actually meant is it maybe effective against the keyloggers, seeing that you are actually interested in doing something with that.
Oh, well for that the scrambled keyboard would seem to be the best solution, since it works with existing password systems. The symbols technique would require creating a new password-based system... or at least new interfaces to create it.
I guess the metric to use would be how much extra data does a really smart keylogger have to collect to circumvent this? Screenshots after every keypress? At this point, it's no longer a keylogger and just a virus, which if it's this smart, it can just wait until your wallet is unlocked and extract the encryption key from RAM
PS - Note that if you use the "dynamic" keyboard, the {shift} key is scrambled with everything else, and the keys re-randomize with every key press. If you use the simple scrambled keyboard (which is randomized once), then something that records mouse click locations gets:
(1) Pressing the shift key is not obscured, so you lose one bit per character to the keylogger, which can now see "UULULLLU" where "U" is uppercase/shifted, "L" is lowercase/unshifted. This is likely not enough to brute-force your passphrase, but it's still information leakage, and might make the difference between a weak-but-prohibitive passphrase, and one that is worth brute-forcing.
(2) If you have repeated letters in the passphrase, you further lose a little information with the simple keyboard. i.e. if your passphrase is "9999999", then the recorder sees that your password is 7 instances of the same character.
For the dynamic keyboard, repeated letters and shift presses, all look like different letters, to anything recording mouse-click locations. It's optimal "scrambling", though I truly believe that anything in place that could exploit the simple keyboard, has enough to take your coins, anyway.
Presumably, what you suggested would provide similar benefits as the dynamic keyboard gives you, which is producing a "code" which doesn't have repeated characters and which does not have the equivalent of "shift" presses. My point is that the dynamic keyboard achieves that for you.
