Would a (password + combination of images) be stronger for user's login regarding keyloggers?

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects.

Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random password each time. That way the hacker/keylogger can't guess the next password.


Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story.

You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn't happen to record but no matter how complex you make things or what you do to try to protect the process on the system it is ultimately all security by obscurity. You are hoping the malware hasn't figured out what you are doing and found a way to gather the information they need to bypass it.

The only way to remain secure is to involve something else they haven't compromised, AKA two factor authentication (TFA). A code from a key fob. A code sent via text message/automated phone call.


Would a password combination of images be stronger for users login regarding keyloggers?

Yes, it would be stronger... a little bit. That is not saying much.

A keylogger will catch only the keystrokes and not the selected user images, right?

If you want to be technical, a keylogger logs keys. In the real world, many "keyloggers" also log things other than keys. See these answers:

Can I protect against keylogging by using the mouse?

How easily are keyloggers foiled?

Malicious software that only logs keyboard strokes rarely exists in the wild. Most key loggers for graphical interfaces (e.g. Windows) are more sophisticated and log all user interaction including mouse, copy and paste events by hooking into the operating system.

Key loggers are normally a small subset of a rootkit that may also include the ability to act as a man-in-the-middle (MITM) and capture your credentials or session information without logging any key strokes.

The best way to foil key loggers is not to have them.

Is this enough to defeat keyloggers?

Heck no.

That all being said, the sort of mitigation you're talking about may have some small ability to discourage those black hats that are harvesting passwords en masse, since it will be harder for them to publish and collect payment for their findings (it's pretty easy to supply your customer with a CSV file of user names and passwords, it's a bit more work to include images and mouse clicks for each and every victim). This is not much of a reason to go to the trouble, to be honest. If you are being targeted individually, then the scheme you're talking about would offer almost no protection.

Images still have a role in authentication-- you can use them to help your users identify phishing attacks by providing personalized images-- but in terms of defeating keyloggers, you really need to go with OTP, i.e. with a key fob or out of band. Even OTP isn't going to protect against real time attacks but it is a pretty good way to protect against password harvesting.