Question About Keyloggers (not Creating One!)

[sdrawkcab]

Hi.

I am creating a script to help manage my online passwords. The idea is that I'll go to a login screen (for example, for this forum), click in the password box, and then hit a certain hotkey. At this point my script will pop up asking for some details, generate a password using those details, and then send it to the active window.

I wish to make this script as secure as possible, and I am worried about the possibility of keyloggers. If I use the Send command to input the password, will the data be accessible to any keyloggers which might be running? Would it be the same as if I had typed the same data in using my keyboard? If so, is there a better way to do it? I can't send directly to the control as the script is multipurpose and would have no way of knowing what control I am inputting to.

I considered something like this:

clipPut($password)

Send("{CTRLDOWN}v{CTRLUP}")

clipPut("")

Then the only data which a keylogger would see would be ctrl+v. However (a) I'm not keen on the idea of storing my password in the clipboard even temporarily, and ( this would inconveniently wipe the contents of the clipboard every time I used it.

Anyone have any suggestions?

Thanks.

Edited April 27, 2006 by sdrawkcab

[SmOke_N]

I would think your only other option would be something you don't wish to use (ControlSetText()).

P.S.

Send("{CTRLDOWN}v{CTRLUP}")

Is the same as

Send('^v')

[Thatsgreat2345]

yeah probaly have a password file , which can read it and show up in some GUI which you can then when u press ctrl v itll pop up ask what you want to paste and then do control set text :-/

to make it secure you can use _StringEncrypt to encrypt the stuff

Edited April 27, 2006 by thatsgreat2345

[sdrawkcab]

Well the idea is that the prog generates the password on the fly so that there is no need to have them stored anywhere. It uses a hash algorithm to generate a unique password based on a keyword (e.g. "autoit forum"), the username, and a master password. I enter all that stuff, and then it generates the password and enters it for me. Storing the data in a file would defeat the purpose.

So I guess I have to either worry about keyloggers (use Send) or have my clipboard wiped each time? Is there a way that I can save the old clipboard first, and then restore it after I'm done? ClipGet only deals with text as far as I can see.

Does anyone know for sure whether Send can be detected by keyloggers?

Thanks again for any help.

[SmOke_N]

Does anyone know for sure whether Send can be detected by keyloggers?

It initiates a keydown..., so I would say the answer is yes.

[w0uter]

i would do it like this:

you could generate one

save the clipboard (clipget)

put it on the clipboard (clipput)

ctrl v (send)

restore the clipboard (clipput)

like you said clipget works only with text. but so does clipput afaik

but ofcourse smart keyloggers would hook the clipboard

Edited April 27, 2006 by w0uter

[sdrawkcab]

True. But I figure most of them won't bother to do that. The trouble is of course that if I have a picture or other non-text content in the clipboard then ClipGet/ClipPut won't restore it. Is there a way of retrieving and restoring the clipboard no matter what its content is?