How can I protect against keystroke loggers on the client machine?
Keystroke loggers on the end users machines can sometimes ruin all our efforts of securely transmitting and storing the passwords. The users themselves may not be aware that a key logger has been installed on their machines and records each key pressed. Since the highest risk is with the password, if we can authenticate the users without having them use the keyboard, or reveal the entire password, we solve the problem. The different ways of doing this are: • Having a graphical keyboard where the users can enter the characters they want by clicking the mouse on it. This is especially useful for numeric PINs. • Asking the users to type a part of their password each time and not the whole password. For example you could say “Please enter the 1st, 3rd and 6th letters of your password” and this rule could be a random one each time.
