Henu the Great said:
Btw, the notepad I was talking about was the good old pen and paper. It has it's limitations, but it is safe from network side of things.
I used to recommend the use of a note pad instead of a password manager, but I have to take that back.
There are multiple problems with keyboards, which makes them unsuitable for entering passwords:
- keyboards run software of which we know nothing about
- keyboards have hardware of which we know nothing about. Maybe there are antennas in them which could broadcast every keystroke
- every key emits a distinct sound, which could be captured by a nearby "smart" device and forwarded to the usual suspects
- every key press generates a distinct RF signal
- USB cables are not shieled and communication between keyboard and computer is not encrypted or very poorly encrypted, allowing for remote eavesdropping of the signals
Due to these concerns, I recommend using KeePassXC.
When you generate a password with it, you should not show it on the screen.
After you generate your password, add a few random characters at random locations.
To use the password, either use the auto enter function or copy it to the clipboard and paste it in the destination app. After 10 seconds the clipboard is automatically cleared.
Keep in mind that all running apps can take screenshots and can see the contents of the clipboard. So minimize the amount of running apps when dealing with passwords.
Btw, most screens also emit RF radiation that can be picked up remotely.
https://www.engadget.com/2008-10-20-keyboard-eavesdropping-just-got-way-easier-thanks-to-electrom.html
Eavesdropping Video Monitors With TempestSDR RTL-SDR : https://www.youtube.com/watch?v=QjqpKtGNbQo
Keytap (audio eavesdropping software): https://github.com/ggerganov/kbd-audio
Solutions against eavesdropping:
- shield USB cables
- put the keyboard inside of a faraday cage (you can find flexible, transparent, very fine knit faraday cages that are like cloth)
- put the screen inside of a faraday cage (there are very transparent metallic meshes that you can put over the screen)
Henu the Great said:
Relevant mention is that US has ordered assassinations/attacks based on metadata alone. In other words not the content of the message, but by determining who sent who, when and how much or many.
They do kill people based on metadata alone:
https://youtu.be/kV2HDM86XgI?t=1079