The Dangers of Keyloggers

Thanks Bibliofuture!

Bibliofuture has done an important service by posting this story. I hope all LISNews readers will read it, but especially those who work in libraries having public access workstations. Perhaps I’m paranoid, but it is because of the fear of keyloggers that I seldom use public access computers, whether in libraries or at conferences, to check email or do other sensitive or password-protected tasks.

Just as we must be vigilant concerning government intrusions into our and our patrons’ privacy via e.g. the Patriot Act, so also we must watch out for more mundane dangers. Cryptography is a great thing (of course, I’m a hypocrite in this regard because I haven’t yet gotten around to integrating GPG with mutt 🙁 , but it is of no use if our keystrokes are intercepted before they are encrypted.

In libraries with stand-alone workstations as public access machines, it may be wise to re-ghost each workstation nightly from a known good disk image. In this way, any naughty software installed in the course of a day is wiped, and the ankle-biters have to go through the trouble of reinstalling logging software if they want to continue to log.

Libraries with higher geek quotients may wish to consider the fascinating Linux Terminal Server Project for Libraries project from Meadeville Public Library. Because it uses diskless thin clients that boot from a single copy of the Linux software on a single server, the system software can easily be protected with strong permissions, read-only filesystems, and filesystem integrity-checking software like Tripwire. I saw a presentation of Meadeville’s work at some conference or other, and I found it so cool that it almost made me want to go back to working on securing public access workstations for the public library. Almost. Seriously, check it out if you have the people to support it. It can also reduce hard- and software maintenance headaches as well.