I wonder if it will work.

Topics: Technical Issues
Jan 5, 2016 at 1:37 AM
Edited Jan 5, 2016 at 1:41 AM
Dear Veracrypt Admin and fellow users,

I have a question about the following method against keylogging of Veracrypt's password. Suppose my OS is infected and a keylogger is installed on it. When entering VC's password within the OS to decrypt a file, suppose the password is 123abc123, and I first input "123" by keyboard, and in the WordPad I have a page when "abc" is on it and I copy this "abc" and paste it in the VC's password input space, and then I finish inputting the rest of the password "123" by keyboard.

In the above case, the keylogger should just be able to log the first "123" and the last "123" that are entered through the keyboard, but it's not able to capture the whole password as the middle part ("abc") of the password is missing from the logging. I wonder if this understanding is correct? If it works, I think this method will also work against keylogging whenever a password is entered within the OS (e.g. Hotmail's and Yahoo's password, forum's Password, etc). I think the time when it doesn't work is when entering password for an encrypted OS because there is nothing to "copy and paste" to begin with in the DOS screen.

Thanks in advance for your reply.
Jan 5, 2016 at 8:04 PM

keyloggers these days do much more than simply logging keystrokes. They usually come with other malware components that monitor user activity and detect several actions like copy-past and file access. So, the strategy you are describing will not work with this kind of sophisticated malware.

For the position of VeraCrypt towards malware, please read this chapter in the documentation; https://veracrypt.codeplex.com/wikipage?title=Malware