Hacker News Reader

Comment by cyberlab | Hacker News Reader

I always wondered about JS-powered keyloggers. What if you type your Linux admin password, or other sensitive things by accident into the webpage and it all gets scooped up? Yes: the keylogger would have a privacy policy in place, but it irks me to think I could accidentally reveal my dearest secrets into some nosy webpage.

View on HN

An even creepier analog to this was a big problem in mobile apps until Apple squashed it by telling everyone when it happens. Mobile apps were recording the clipboard every time they gained focus and many then uploaded that to the web. Copy pasted passwords... email addresses... etc.

Yes, pasteboard scraping and exfil was rampant prior to Apple's new prompts.

Ideally it shouldn't matter that it happens. I mean, it's not great and if you're aware of this, you should roll your password, but realistically the external services should have no way to interact with your admin account.

For better protection you can use totp codes or some type of security token which makes password leaks useless.

This, but with everyone using Grammarly which is effectively a keylogger browser extension.

Fortunately for me, Grammarly has so alienated me with its relentless, irritating ads that there is no possibility that I will ever install it.

I've found LanguageTool(https://languagetool.org/) superior overall. It's open-source and is recommended by Firefox.

There are other ways that could happen, too, for example a chat window or a search bar.

Change your password asap.

And if you're running X: any window can just decide that it wants your keystrokes anyway.

Yes that's what I forgot to mention. Windows can steal focus and you could accidentally spill secrets into them

With X they don't even need to steal focus. They can just copy all the keystrokes. Wayland fixes this.

I often think about this when I see services that does stuff with your input to help you. For example online JSON formatters, online RegEx testers and such.

Reply on news.ycombinator.com