Editing Keystroke logging (section)

=== Security tokens ===
Use of [[smart card]]s or other [[security token]]s may improve security against [[replay attack]]s in the face of a successful keylogging attack, as accessing protected information would require both the (hardware) security token as well as the appropriate password/passphrase. Knowing the keystrokes, mouse actions, display, clipboard, etc. used on one computer will not subsequently help an attacker gain access to the protected resource. Some security tokens work as a type of hardware-assisted one-time password system, and others implement a cryptographic [[challenge–response authentication]], which can improve security in a manner conceptually similar to one time passwords. [[Card reader|Smartcard readers]] and their associated keypads for [[Personal identification number|PIN]] entry may be vulnerable to keystroke logging through a so-called [[supply chain attack]]<ref>{{cite web|url=https://www.theregister.co.uk/2008/10/10/organized_crime_doctors_chip_and_pin_machines/|author=Austin Modine|title=Organized crime tampers with European card swipe devices|date=2008-10-10|access-date=2009-04-18|website=The Register}}</ref> where an attacker substitutes the card reader/PIN entry hardware for one which records the user's PIN.