36

How can I, if possible, safely use password-protected websites (eg GMail) on internet cafe computers?

I've heard people say that it's not really safe to use password-protected websites on internet cafe computers, because they may have malware installed which can steal passwords which are typed in.

One option would be to make your website use two-factor authentication, but that doesn't feel practical to me, as since I'm out of my home country they can't necessarily send an SMS to me, and I don't want to carry a list of security codes with me.

Improve this question
17
  • 9
    I'm voting to close this question as off-topic because this is a duplicate of webapps.stackexchange.com/questions/30721/… and security.stackexchange.com/questions/30149/…
    – user4188
    Commented Sep 18, 2016 at 11:46
  • 22
    @chx It can't be closed as a duplicate as it's a cross-site duplicate. These duplicates can only be closed as a duplicate if the question is moved to one of these sites. The question should be closed as offf-topic.
    – AStopher
    Commented Sep 18, 2016 at 15:03
  • 4
    I know it can't be closed as a duplicate, I marked it as off topic sorry if the wording is not perfect. Perhaps I should've said "it's already answered at X and Y".
    – user4188
    Commented Sep 18, 2016 at 15:18
  • 6
    I wouldn't say it's off topic here since this is an actual problem that travellers face, but security.SE is full of very knowledgeable people in this realm. I did remove the international travel tag since the same can happen at your local internet cafe in your city.
    – hippietrail
    Commented Sep 19, 2016 at 1:41
  • 17
    This is absolutely on-topic for Travel.SE, and should stay open. Posts in other SEs are fine as references in answers though.
    – lambshaanxy
    Commented Sep 19, 2016 at 5:48

15 Answers 15

Reset to default
59

If the security is password only, the answer is that you can't: if they're logging your keystrokes, your password will be compromised, period.

However, the best two-factor authentication system while on the road is not SMS, but app-based authentication like Google Authenticator. All you need is your mobile phone for generating the codes, and it doesn't even have to be on the network/wifi.

Of course, the best option is to bring your own laptop, so all you need to worry about is compromised wifi.

Improve this answer
14
  • 3
    If you can use google authenticator, why wouldn't you use gmail on your phone?
    – Berwyn
    Commented Sep 18, 2016 at 15:30
  • 19
    @Berwyn It might not be possible to get the phone online. Or the limited UI on the phone might not be sufficient for what you need to do online.
    – kasperd
    Commented Sep 18, 2016 at 15:39
  • 3
    @kasperd I forgot google auth was time based. I was thinking of Duo Mobile which I'd been using recently. Good point
    – Berwyn
    Commented Sep 18, 2016 at 15:43
  • 4
    @l0b0 If you have spies following your every move realtime, you've probably got bigger problems. Also, I'm pretty sure most major sites would flag multiple simultaneous logins with the same 2FA code as suspicious.
    – lambshaanxy
    Commented Sep 19, 2016 at 11:10
  • 2
    @MichaelHampton when TOTP is used, usually a offset of a few minutes is tolerated. You should be able to manually set the clock of your phone within a few minutes accuracy. Only thing to keep in mind is to set the time zone correctly (else the time looks right on the phone but is actually a few hours off!)
    – Josef
    Commented Sep 19, 2016 at 14:46
10

The correct behaviour is NOT to trust the computer.

When I log in at one, if I can't insert a USB stick with my own copy of Firefox on it for browsing, I'll load theirs up, but will make sure it's updated first to the latest version, for security (or whatever other browser they might use).

I'll then check the running tasks on the machine and see if anything looks suspect. This is harder for someone non-technical to do as you may not know which processes are part of Windows etc, but it's a step.

For your actual password, if you're worried about keylogging, you could always just type a letter, then in an open notepad type a bunch of garbage, then the next letter, and repeat. Unless their keylogger is sophisticated enough to be application specific, of course.

At that point, you'll want to consider two factor authentication. Get either an SMS or in-app message with a code that you type in (Gmail and more can be set up for this), or a QR code that your phone scans on the screen (Whatsapp web does this).

If you're getting really fancy you could stick an operating system on a USB stick, prebuilt with the browser of your choice etc and then boot the machine to that, but it depends on you being able to get into the BIOS, or what other admin restrictions they've placed on the computer (or if you can even reach the USB port).

Afterwards, clear the cache, cookies etc of the browser, and I tend to reboot the computer when I leave as well, as some internet cafes are set to reinstall everything from scratch on reboot, wiping any trace of me having been there (I once worked in an internet cafe where we did this).

Improve this answer
10
  • 8
    then in an open notepad type a bunch of garbage That is useless nowadays. Many keyloggers have screenshot capabilities.
    – user40521
    Commented Sep 18, 2016 at 12:38
  • 13
    @MarkMayo An application running in the same user context on a Windows machine can grab the contents of a password field, whether it is displayed on the screen or not. I am sure there are key logger-style apps that do this automatically, since combing through keystrokes to find a password is already dull. The fact is, you can make things a bit more difficult for the attacker, but if he controls the machine your efforts are largely pointless.
    – Calchas
    Commented Sep 18, 2016 at 14:37
  • 1
    @Calchas agreed, much the same as if a video camera is pointed at the user subtly. Nothing is ever totally secure, but 2FA goes a long way to helping these days.
    – Mark Mayo
    Commented Sep 18, 2016 at 14:38
  • 13
    The only thing you achieve by inserting your USB stick with portable firefox is getting it infected with viruses. Running software from own disk on a compromised computer does not make it any less compromised.
    – R.. GitHub STOP HELPING ICE
    Commented Sep 18, 2016 at 15:30
  • 6
    What good does using your own copy of firefox do on a compromised machine?
    – Berwyn
    Commented Sep 18, 2016 at 15:31
6

How can I, if possible, safely use password-protected websites (eg GMail) on internet cafe computers?

You cannot, at least without using two factor authentication (or some other kind of token that is independent of the local machine). You should consider anything typed or viewed on a public machine to be public information.

Unless you have exercised total supervision over the machine and the software on it since it was built, you cannot trust the machine not to intercept your password and all other keystrokes. Without a second authentication factor, this will be sufficient to access all your details, either in real time or later.

This interception could happen at the software level (which you can in most cases defeat by carrying a USB stick containing your own operating system) or at the hardware level.

Improve this answer
4
  • If the operators have any competence at all, booting from USB will be disabled. And if they have average competence, running apps from USB or installing VMs will be disabled. And even if you use two-factor, no guarantee they aren't saving screenshots or using a modified browser to capture text from the pages you fetch and the other (non-password) text you type.
    – WGroleau
    Commented Sep 18, 2016 at 14:31
  • @WGroleau but why would you assume that the operators are competent? :)
    – Calchas
    Commented Sep 18, 2016 at 14:33
  • If you're worried about spies, why would you assume they aren't? I have been in places where these simple protections were installed when other things indicated IT incompetence.
    – WGroleau
    Commented Sep 18, 2016 at 14:37
  • 3
    On the other hand, attempting to boot USB will either succeed or fail, no harm done. Unless they're REALLY talented and know how to detect the attempt and erase your stick. I read an article not long ago about an exploit that involved a modified boot ROM that would infect USB devices as soon as they were plugged in.
    – WGroleau
    Commented Sep 18, 2016 at 14:40
6

Everyone is saying two factor authentication. They are mostly wrong, in that two factor is in most cases a password and something else, and this will definitely risk compromising the password and may compromise the something else. Two factor may be useful, but the best solution is single use credentials. If you have a trusted device like a cellphone that you can use to change your password you can change the password, use the untrusted computer and then change your password back. This presents a limited window where the password is vulnerable, but it may be too long. One time passwords are a better solution to this use case. There are several implementations of one time passwords varying from books to TOTP (google authenticator). The one challenge is that all of these require server side support which is spotty at best. For the moment the best practice advice to users is don't.

Improve this answer
4
  • 1
    So you're saying 1FA is better than 2FA then? ;)
    – Berwyn
    Commented Sep 20, 2016 at 3:26
  • Yes, in a sense 1F is better than 2F, because the overwhelming issue is the human factor. If you're about to be MITM en route to your luxembourg bank for naive users (ie, 99.999999999999999999999999999999999999999999999999999999% of living humans) the 2F is an illusion. To put it more simply, 2F is convincing people it's OK to use really insecure physical devices. All the talk about password capture on here by non-experts is a good example: there's heaps of badness that can happen to you if you connect to your bank (or even just email) and they DON'T get your passwords; it's all a bit silly.
    – Fattie
    Commented Sep 20, 2016 at 5:08
  • @Berwyn, the advantage 2fa has is that by having multiple credentials compromising one is not a total compromise, however for this specific use case every authentication method is vulnerable to compromise. Therefore for this case you want to only use credentials that are disposable so that the compromise of the credentials does not matter. That is why I recommend OTP only for this use case. A second credential of a different type would be of value if we could find another that was not vulnerable to instant compromise. the only other candidate that I am aware of is a challenge response (cont)
    – hildred
    Commented Sep 20, 2016 at 12:43
  • (cont) but challenge response is fairly complicated to securely implement in this use case in that the public computer cannot be used to do any of the calculations involved.
    – hildred
    Commented Sep 20, 2016 at 12:46
5

An alternative to 2FA is to use a USB Armory device. This plugs into your USB port and runs an independent OS. You can interact with the device in any way you could wish to, such as using it as a web server, an ssh client or a VNC/RDP server so that the device itself invokes the secure session with the target server. The keys/passwords could remain on the device and not be made accessible to the host computer.

Improve this answer
10
  • 6
    Every software based solution is not good enough -- what if the keyboard is bugged? Remember when Andy Davis crammed a RasPi inside a Dell dock and tapped Ethernet VGA and keyboard and sent the data stream out on a HSDPA modem? That was fun...
    – user4188
    Commented Sep 18, 2016 at 16:29
  • 2
    @chx It doesn't matter if the keyboard is bugged, because you don't enter your password on it
    – Berwyn
    Commented Sep 18, 2016 at 17:47
  • 1
    Given the number of upvotes of @chx's comment, I'm not sure if people understand what this device is. You can think of it as an HSM performing authentication on your behalf. You wouldn't use it to type a password into as that would be pointless
    – Berwyn
    Commented Sep 19, 2016 at 14:19
  • Is it a U2F device then?
    – user4188
    Commented Sep 19, 2016 at 15:13
  • 1
    @chx As an example, vnc into the USB armory and use a browser to access a webmail service. The browser on the USB armory can be configured to autofill the password field. The password would never leave the device except over SSL to the webmail service. Your password wouldn't be exposed.
    – Berwyn
    Commented Sep 19, 2016 at 18:24
3

Use two factor authentication. This is when, in addition to a password you put in a sequence of characters that you are sent (either by SMS or otherwise). This is how I set it up without because on roaming SMS doesn't always work.

  1. Install Google Authenticator for Android or IOS store
  2. Follow the instructions here to set it up.
  3. Set up your google account to use two step authentication using your Authenticator app. The instructions are here

Now each time you need to log in, when prompted, just open the Authenticator and put in the key. Don't worry, the key changes every 15 seconds so even if someone tried to log in with the keys they recorded, it wont work. And you can later check access by clicking access history at the very bottom right of your Gmail page.

You can check out more on Authenticator on Wikipedia, just type in Google Authenticator.

Improve this answer
3

Googe Mail and Fastmail.fm both support U2F so you can use those via that key if the place you are allows plugging in random USB devices. I am not sure what other websites support it. If you have your own control, you could instead get a Yubikey Neo and implement Yubikey auth for your site. It's alas rare.

Improve this answer
2
  • +1. I have a yubikey and it holds my ssh private key. I can login to my VPS to read my email using it.
    – Berwyn
    Commented Sep 19, 2016 at 17:19
  • 1
    This is a perfectly good device to plug in your own computer. Plugging it into a compromised machine, on the other hand, is not so different from typing your password.
    – Dmitry Grigoryev
    Commented Sep 20, 2016 at 13:27
2

If you use two alternating passwords this provides a bit of protection when you have only one session at each internet cafe: In the first internet cafe you log in with password 1 and at the end of the session you change the password to password 2. In the second internet cafe you do the login with password 2, and at the end of the session you change the password back to password 1. If the attacker only analyzes the first password you entered (the one you used for the login), then he can't use this password for a login because it was changed by you at the end of the session.

This approach won't help if the attacker analyses the full protocol written by the keylogger, but maybe he isn't so patient or doesn't get the idea that you simply changed the password at the end of the session.

Improve this answer
3
  • This assumes hacker can intercept the password you enter at the start of the session, but not the one at the end. How would that happen?
    – Dmitry Grigoryev
    Commented Sep 20, 2016 at 13:19
  • As I wrote in the last sentence of my answer: This approach helps only if the attacker is so "sloppy" that he doesn't scan the end of the data recorded by the key logger for passwords. If you log in, write some e-mails, then change the password, and write some more e-mails, it will be rather hard to detect the second password in the data recorded by the key logger.
    – user1364368
    Commented Sep 20, 2016 at 14:26
  • Since changing the password typically requires you to repeat the old one, it would be quite easy to detect. Modern keyloggers also tend to take screenshots every few seconds.
    – Dmitry Grigoryev
    Commented Sep 20, 2016 at 14:30
1

As others have mentioned, there are very few safety rules you can enforce on a machine you don't control.

The best solution would be to carry your own laptop, tablet, smartphone and simply borrow the Internet connection.

Once you get a hold of the Internet connection, use a VPN provider to secure your connection. There are many ways, to do this from using a browser that has one built-in, or a VPN client on your mobile. You can get free lifetime subscriptions at some VPN providers for a nominal amount.

The VPN provides a level of privacy over the (public) Internet connection.

Next, you can follow the normal security steps such as enabling two factor authentication on your account.

Improve this answer
2
  • a VPN won't protect you from key loggers
    – EdmundYeung99
    Commented Sep 20, 2016 at 3:16
  • 2
    Of course, we assume there are no keyloggers on your own personal laptop/computer/tablet.
    – Burhan Khalid
    Commented Sep 20, 2016 at 4:37
1

Related musings of possible value. Or not.
'cafe' = internet cafe or equivalent.

Comodo sell a product that allows https encrypted connection to their site and then connection to where-ever. That addresses most in-PC and beyond exploits - Note however jpatokal's comment on keyloggers. (My only relationship with Comodo is as a sometime paying and sometimes free-product-using user.)

I've seen internet cafe's where NO access to the machine proper was available - you got cables through a physical wall. (That may have been Dublin or Prague (or both)).

It's common enough to not allow cafe users access to USB or DVD/CD

I've used "Team Viewer" remote access software from China to a home computer system in NZ. That's probably worse as it has the potential to give them access to my NZ system - but it does give the ability to implement a challenge and resonse system where the "2nd factor" could be a mentally simple but "inobvious enough" system. Couple that with Comodos system and you'd be making it very hard to make sense of keylogger data. ... You can eg move a mouse pointer over a remote screen and if you are keen enough do something like that blind with a remote screen disabled while you do it but the mouse still live.

In my case I could also communicate with my wife over the link - adding some 3rd party who achieves "personal factor authentication" from a distant country is liable to be reasonably effective.

I've only had my access compromised once AFAIK when "abroad". A public WiFi session at Hong Kong airport resulted in (AFAIK) me being locked out of GMail from China only a few hours later (before the Chinese barred GMail) but the account recovery system got me back in.

________________________________________

Fun only: I've sat in a Shenzhen cafe next to a largish team of Chinese guys intently playing the same game. Not my territory but my son wondered from the screens visible in photos I took if these were some of the fabled China based miners who make real $ by obtaining and selling in game product for that specific game. Unknown and unknowable - but a fun thought.

See :-) -

Top - part of the Shenzhen team. Bottom - internet related 'meme'.

Improve this answer
1

You should understand how unsafe an unsafe computer really is.

Assume they:

  • Are recording every keystroke you make.
  • Are trying passwords you enter - protected by two-factor or not - into other websites as you may of course recycle passwords.
  • Record everything that appears on screen, including anything open in your email, or on your Facebook, or so forth.
  • Know your contacts, and can probably steal your identity.

Now, are public computers that scrape passwords to common websites, but stop short of anything else they could do, common enough? I have no idea. But it is very odd to me to trust a computer to use it as long as you can protect your password from it.

Improve this answer
1

To protect your password on a public computer (or any device for that matter), use a password manager such as Password Maker that generates a unique password for you, per website.

You use a master password (which is not actually used for any website) and a whole bunch of other information to generate a password for a particular website you want to access. You then copy + paste the password to log-in thus never typing your password and so it can not be captured by a key logger.

Combine this with the other suggestions on this Q&A (use a VPN, 2 Factor Auth, don't use a public computer but rather use your own device etc)

Improve this answer
1

I was going to stay out of this one, but seeing all these answers suggesting two-factor auth and a bunch of naive anti-keylogger tricks will somehow make things right is just incredible.

Sink it in: the only secure way of using secured websites on a compromised computer is not using them. From the moment you made a remote server (GMail, your bank, etc.) trust the computer you're using, they will trust whatever whatever that computer is sending to them, and you have little control over that.

Some banking sites are aware of this problem and require you to authenticate every single action you're trying to perform, to make sure all actions come from the actual user. Many others don't. GMail certainly does not. Once you're logged in, it will happily give away your mail archive to the hackers while you're reading that new e-mail you've received.

If this sound surprising, open GMail in two tabs, and imagine you're using one while hackers control the other, without you seeing it. That should give you a good idea of what's happening on a compromised computer.

Improve this answer
4
  • What of the many options mentioned here of logging into another computer? I thought it's much harder to do malicious things the way you describe with VNC since there is only one thread.
    – user4188
    Commented Sep 20, 2016 at 12:51
  • Hrm? VNC doesn't require USB?
    – user4188
    Commented Sep 20, 2016 at 13:24
  • VNC still won't prevent keylogging, and using it assumes you can add USB hardware to the computer (you have to get it running from somewhere), at which point I would consider unplugging its Ethernet cord and plugging it into my own PC.
    – Dmitry Grigoryev
    Commented Sep 20, 2016 at 13:41
  • Are you assuming that VNC software is pre-installed on the public computer? At which point it could be modified to provide as many threads as its authors see fit.
    – Dmitry Grigoryev
    Commented Sep 20, 2016 at 13:46
1

You can, use VPN and 2FA together with a Windows-To-Go x86 (32-bit) USB drive. This way you won't need to actually carry a huge list of passwords or security codes OR you could just use a Linux persistent storage drive (with VPN of course)

VPN
Official WTG
Unofficial WTG can also be used

Improve this answer
-1

One important trick that nobody discussed here!

Key loggers record your keystrokes in sequence.. period!

You can make them fool by typing your first letter of the password, then a few last letters, then place your cursor at the exact middle place where you left off, and write remaining characters.

you can randomize it even further by keep switching cursor position. Remember don't use keyboard arrow keys to switch cursor, use mouse ;)

This trick will fool any keylogger even the one that is application specific.

Off course this is only for key loggers, public computers can have a lot of other issues too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .