[117000] in Cypherpunks
Re: Project: Hardening Crypto Against Big Brother's "Black
daemon@ATHENA.MIT.EDU (Sean Roach)
Wed Aug 25 00:22:56 1999
Message-Id: <3.0.6.32.19990824230422.007c0ec0@mail.intplsrv.net>
Date: Tue, 24 Aug 1999 23:04:22 -0500
To: cypherpunks@algebra.com
From: Sean Roach <roach_s@mail.intplsrv.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Reply-To: Sean Roach <roach_s@mail.intplsrv.net>
I just thought of a possible way to get around at least some keyboard
sniffers.
If the keyboard sniffer was a user level program then it might be possible
to, while the password entry was in progress, "randomly" remap the
keyboard. For instance, if the password is NOYB, which I suspect more than
should probably use, and the next four "random" numbers are 2, 13, 4, 8.
Trade the N with the P, followed by changing it back and changing the O
with the B, then back and chaning Y with C, then back and B with J, and
back. This way, this once, the correct passphrase isn't NOYB but PBCJ.
Next time it could be RLKV.
This would not help at all if the keyboard sniffer were in fact installed
in the keyboard, nor would it do any good if the keyboard sniffer got its
data at a point in the data stream where an ANSI bomb couldn't affect it.
It might help in filling the holes in a multiple verification scheme
though. Get a selection of buttons from the mouse. Since the mouse tracks
further if you move fast then if you move slow, the mouse itself can not be
easily bugged in hardware. Get a passphrase. If the sniffer is at a level
that it can get the clicks of the mouse, then it is probably enough levels
from the OS that remapping the keyboard can affect it, since it's relying
on the drivers for the mouse at least to know what happened. Then go ahead
and get your voice sample or question and answer session just to defeat
sniffers altogether.
Just an idea, and I don't know if an ANSI bomb can mess up win9X or not.
Sean Roach
