Attacks · Credentials & humans
Captured input does not become lasting request authority. Bearings and ceremony fragments are one-shot — already spent by the time an observer could reuse them.
~6 min readRelated: Phishing
The keylogger wants recorded keystrokes, paste buffers, or ceremony input to work again later as a password-like credential. The conversion is capture-to-login: film the human, replay the string, own the session on another host. Keylogging is privacy-invasive even when it fails to mint lasting authority — deny conversion, do not romanticize malware.
Passwords and reusable OTPs make keylogging pay because the typed string is the secret. Ambient estates put lasting value into every keypress. Malware, shoulder surfing, and shared terminals all convert surface input into lasting callers. Cognitive ceremonies move lasting value out of the keystream and into one-shot bearings.
Nothing typed has lasting value as a channel authorizer under one-shot bearings. Ceremony input burns with the request. An observer notebook of surface input does not yield a second authorization — the nonce is already spent. Keylogging still violates privacy; it fails as an ambient-credential mint. If a notebook of keystrokes cannot authorize a second call, the ambient password model has been replaced.
Read the dual plates as ambient success versus mechanism denial for keylogging: the surface plate shows why classical estates pay; the denial plate shows which ENI6MA check family stops the conversion without dumping an NDA attack-to-stage matrix. Claims below stay model-scoped.
Keylog captures the password
How to read: observer notebook left; replay-string ambient win right. Takeaway: typed input is a reusable secret.
Ambient keylog success is the password string that logs in again elsewhere.
Keylog captures spent work
How to read: password-reuse myths fail; bearings → burn → already spent. Takeaway: surface only; authority spent.
Spent bearings leave the notebook with surface only — already burned.
Immune to keylogging.ValidatedNothing typed has lasting value; bearings are one-shot and already burned by the time an observer could reuse them.Holds under the reference architecture
Pass+ / cognitive ceremony input is not a reusable password.
This essay critiques the systemic problems not addressed by contemporary passwordless trends (passkeys, FIDO tokens, and mobile MFA apps). While hardware-bound credentials reduce phishing and stuffing for interactive users, the author argues they bind users to specific devices and vendor escrow or sync services, ceding sovereignty over storage and recovery.
Written for challengers who worry that watching multiple successful logins reveals the password and private map, or that random guessing eventually hits both, this essay explains why those paths do not work for the ENI6MA rotating-ring method (not mathematically, statistically, computationally, or physically).
This accessible paper explains how the ENI6MA / Rosario–Wang Proof uses cognitive methods to protect the witness (the hidden information that proves identity or knowledge) without exposing it during authentication. Minds (human or artificial) perceive patterns, map symbols to private meanings, and make fast membership decisions; ENI6MA builds an interactive ceremony around those abilities.
A quantitative information-theoretic analysis of how much an adversary can learn by observing a complete ENI6MA / Rosario–Wang authentication ceremony. The paper separates surface bits (Shannon entropy of symbols an observer can record) from effective bits (secret-relevant mutual information those recordings pin down), and argues that effective mutual information with the secret remains zero across rounds and ceremonies under the named model.
Keylogging immunity claims concern lasting channel authority, not the absence of endpoint malware.