Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I have just got back from holiday, I was not willing to check my email form the hotel’s “internet café” PC, as I could not think of a way of eliminate the risk that it had a “password logging” worm, virus, or intentionally install application. (Someone could even have installed a hardware keyboard logger into the keyboard socket!)

So is there any way to access web applications safely from untested machines?

(I would rather not take the risk of my laptop getting stolen on from the hotel room, and not all vacation type hotels have wireless internet yet anyway)

share|improve this question

4 Answers 4

up vote 5 down vote accepted

The password manager LastPass has a screen keyboard and also one-time-use passwords. The screen keyboard is specifically to avoid key loggers and one-time-use limits the value of the password if it is intercepted..

share|improve this answer
    
are you using it? For years I was using the PasswordSafe and I was storing the encrypted file into Dropbox.. but the version for MacOS sucks.. and maybe it's time to change.. –  Lipis Jul 17 '10 at 10:50

If you don't own the machine, there's no way to be certain that something isn't installed to capture keystrokes. I wouldn't log into a public machine to do anything other than check the news, ever.

If it's your own machine, you can use a secure (SSL/TLS) connection to your e-mail provider via someone's WiFi. That should be reasonably secure (though there's always the possibility of a man-in-the-middle attack).

share|improve this answer

Google 2-Step Verification would seem to be the answer.

Signing in to your account will work a little differently

  1. Enter your password

    Whenever you sign in to Google, you'll enter your password as usual.

  2. Enter a verification code

    Then, you'll be asked for a code that will be sent to your phone via text, voice call, or our mobile app.

So, even if there is a keylogger, unless the bad guy can also get your phone he can't get into your account.

If you have a smartphone there's also an app for generating the verification code.

share|improve this answer

Instead of using the GMail web interface, setup SquirrelMail (remember GMail supports IMAP) on your desktop or server and use the one-time password plugin.

share|improve this answer
    
As far as I can see QquirrelMail needs to be installed on my server/pc so is not a web app. –  DoNotInstall Jul 17 '10 at 10:23
    
Correct . . . . . –  Gelatin Aug 4 '10 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.