Internetworkers: http://www.ibiblio.org/internetworkers/

[Tanner Lovelace <lovelace AT wayfarer.org>]

Thomas said the following on 7/27/04 8:48 PM:

> Shea Tisdale wrote:
>
> > And don't forget that if I really want to know what you are putting into
> > your documents I'll just use a keystroke grabber...
>
>
> Okay, humor me here.  Wouldn't a keystroke grabber require:
>
> - compromising my computer to install the grabber
> - avoiding detection by my various and sundry malware detectors
> - sending data back to you without being noticed by ZoneAlarm or some 
> other firewall?
>
> I reckon the FBI could do this if they really wanted to.  So what would 
> effective protection against this look like?  In addition to keeping my 
> laptop within reach at all times and giving up my wireless connection, 
> is there readily available software that would provide further 
> protection and/or intrusion detection?

The short answer?  Nothing, you're screwed.  Take a look at the case
of Nicodemo Scarfo who was caught when the FBI snuck into his house
and attached a keyboard sniffer to his computer which faithfully recorded
his PGP passphrase.  That said, there are a few things you can do to
increase your security, and Bruce Schneier illustrates them very well
here: http://www.cskk.ezoshosting.com/cs/goodstuff/bs-spc.html

You should probably also look at a few other pages too like these:

http://www.internetweek.com/columns01/secure020701.htm
http://www.disenchanted.com/dis/technology/widget.html

Bruce is probably most famous for a quote out of his book Applied
Cryptography:

“It is insufficient to protect ourselves with laws, we need to protect
ourselves with mathematics.”

Unfortunately, as he later realized, the math isn't the week link
in the chain, humans are.  So, the real thing you should be asking
what kind of a trade-off are you willing to tolerate to gain security?
If someone really wants to compromise your encryption, they're not
going to attack it directly.  Why go through the linebackers when
running around from the side will allow you to sack the quarterback.
Even one-time pads aren't secure, because the key has to be stored
somewhere.  Human fallibility will always win out over good encryption,
so choose whatever key length you feel comfortable with and use that.
If you want to make things more secure, then look at where you keep
your private key, how you manage your private keys, where and when
you type in your private key passphrase, etc...  This is why you don't
actually "sign" someone else's key at a keysigning.  Instead you
exchage enough information to be sure of what you're signing and
who you're signing it for and you go back home and sign it there.

Anyway, this is probably a bit more than you were looking for. :-)

Cheers,
Tanner