extra letters in typed password, a worthwhile endeavour?

Question

I've heard a view quite frequently that key loggers can be beaten very easily by entering extra letters in your password then deleting these (by highlighting with the mouse and hitting delete key).

While this seems plausible, it seems to me that it wouldn't be overly hard for a key logger to overcome.

Is this actually safe advise in this day and age, given the increasing complexity of key loggers...or are there now loggers in the wild which can overcome this practice ?

Answer 1

The keylogger would log that the delete key was pressed, which would tip off the attacker that something may have been modified.

Furthermore, if further captured text indicates that the login was successful, you've given the attacker the characters that your password is composed of. So you've made it MUCH easier for the attacker to brute force your password. So I would say no.

A software keylogger is likely monitoring and recording internal events generated by the operating system, possibly in addition to also monitoring physical I/O coming from PS/2 or USB ports. Couldn't defeat that with mouse highlighting either.