4 ms·
Read the original posts and saw the package capture screenshot. It seems like it sends stats on how many keypresses there are on a key-by-key basis, not an actu
by retSava 9y ago
Read the original posts and saw the package capture screenshot. It seems like it sends stats on how many keypresses there are on a key-by-key basis, not an actual keylogger (ie it doesn't send the content of what you sent).
It sends this in cleartext over http, not https. Again, not the content of what you type, so your url+user/pw is not sent (at least not according to what is known now).
- hamitron 9y agowhy does it send anything at all?
- tyingq 9y agoDoesn't sound a whole lot better. Some diffs against normal character frequency would probably make cracking passwords easier. At the very least, you get a list of characters not to use in a brute force search.
- jnbiche 9y agoTo be clear, if they're sending real-time updates on the keypress counts of each key, it's quite simple to map that to a traditional key logger (ie, the contents of what you typed).
- ac2u 9y agoWas it confirmed realtime though? Could have been batched, which makes it harder to reconstruct what was typed. Even that's a step too far though, but clarification can help draw the line between careless and malicious.