I have just got back from holiday, I was not willing to check my email form the hotel’s “internet café” PC, as I could not think of a way of eliminate the risk that it had a “password logging” worm, virus, or intentionally install application. (Someone could even have installed a hardware keyboard logger into the keyboard socket!)

So is there any way to access web applications safely from untested machines?

(I would rather not take the risk of my laptop getting stolen on from the hotel room, and not all vacation type hotels have wireless internet yet anyway)

4 Answers 4


The password manager LastPass has a screen keyboard and also one-time-use passwords. The screen keyboard is specifically to avoid key loggers and one-time-use limits the value of the password if it is intercepted..

  • are you using it? For years I was using the PasswordSafe and I was storing the encrypted file into Dropbox.. but the version for MacOS sucks.. and maybe it's time to change..
    – Lipis
    Commented Jul 17, 2010 at 10:50

If you don't own the machine, there's no way to be certain that something isn't installed to capture keystrokes. I wouldn't log into a public machine to do anything other than check the news, ever.

If it's your own machine, you can use a secure (SSL/TLS) connection to your e-mail provider via someone's WiFi. That should be reasonably secure (though there's always the possibility of a man-in-the-middle attack).


Google 2-Step Verification would seem to be the answer.

Signing in to your account will work a little differently

  1. Enter your password

    Whenever you sign in to Google, you'll enter your password as usual.

  2. Enter a verification code

    Then, you'll be asked for a code that will be sent to your phone via text, voice call, or our mobile app.

So, even if there is a keylogger, unless the bad guy can also get your phone he can't get into your account.

If you have a smartphone there's also an app for generating the verification code.


Instead of using the GMail web interface, setup SquirrelMail (remember GMail supports IMAP) on your desktop or server and use the one-time password plugin.

  • As far as I can see QquirrelMail needs to be installed on my server/pc so is not a web app. Commented Jul 17, 2010 at 10:23
  • Correct . . . . .
    – Gelatin
    Commented Aug 4, 2010 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.