5 ms·

This is what worries me a bit about browser extensions like 1 password and other password managers. Could a website that has a keylogger in it potentially pick

This is what worries me a bit about browser extensions like 1 password and other password managers. Could a website that has a keylogger in it potentially pick up these keystrokes when I put my password into an extension?

plif 9y ago
No. They only have access to anything inputted within their site's window. I think this article is a bit sensationalist. These sites already have access to all of your data (stored in their databases!). There's nothing additional they are gaining from this aside from how you input that data. That is much less sensitive information and I can't think of another usage aside from improving their site's UX.
- notzorbo3 9y ago
  > These sites already have access to all of your data (stored in their databases!) The assumption for most people is going to be that they have the data that you explicitly sent them. Implicitly gathering and sending data is equivalent to snooping on people without consent. It's all about expectations.
- djhworld 9y ago
  Is there a risk of information leakage? Say for example a website asks me for something (e.g. an address, phone number, bank account number), I type it in (thus registering my keystroke presses to the keylogger) and then realise oops I didn't mean to type that, I meant to type something else Does the website then submit the logged keystrokes for offline analysis?
  - plif 9y ago
    Yes, theoretically in the case you mentioned. All responsible implementations of this won't actually log PII. It's pretty trivial to withhold certain inputs. All of the services mentioned in the article have easy ways to flag an input field as private / do not log. I'd wager a lot of money that these sites are interested in gathering UX data and not scraping for accidental form input. I suppose there's a certain level of trust involved, but I don't think that's any different than when you make an online purchase. /shrug
notzorbo3 9y ago
> Could a website that has a keylogger in it potentially pick up these keystrokes Yes of course. All it takes is misclicking and having the focus on a wrong window, and you're toast.
- haquistiona 9y ago
  Can you explain this more? What do you mean by "focus"?
  - notzorbo3 9y ago
    By "focus" i mean the current window on your desktop that has the focus, as in, the one that's going to receive the input you give through your keyboard. I've seen plenty of people (and it's happened to me too) fumble and accidentally type or paste things in the wrong window. If that window happens to be your browser on a website that does this kind of tracking, that information goes to some random third party instead of the window you thought it was going to.
danenania 9y ago
The risk is actually the other way around. A page can't access data in an extension, but extensions with full permissions (most of them) can access anything on any page. Hacking a popular extension is one of the easiest routes to fully compromising millions of users (and every account they own). People are generally unaware of this danger, but it's much worse than ads or tracking.

plif 9y ago

No. They only have access to anything inputted within their site's window. I think this article is a bit sensationalist. These sites already have access to all of your data (stored in their databases!). There's nothing additional they are gaining from this aside from how you input that data. That is much less sensitive information and I can't think of another usage aside from improving their site's UX.

notzorbo3 9y ago
> These sites already have access to all of your data (stored in their databases!) The assumption for most people is going to be that they have the data that you explicitly sent them. Implicitly gathering and sending data is equivalent to snooping on people without consent. It's all about expectations.
djhworld 9y ago
Is there a risk of information leakage? Say for example a website asks me for something (e.g. an address, phone number, bank account number), I type it in (thus registering my keystroke presses to the keylogger) and then realise oops I didn't mean to type that, I meant to type something else Does the website then submit the logged keystrokes for offline analysis?
- plif 9y ago
  Yes, theoretically in the case you mentioned. All responsible implementations of this won't actually log PII. It's pretty trivial to withhold certain inputs. All of the services mentioned in the article have easy ways to flag an input field as private / do not log. I'd wager a lot of money that these sites are interested in gathering UX data and not scraping for accidental form input. I suppose there's a certain level of trust involved, but I don't think that's any different than when you make an online purchase. /shrug

notzorbo3 9y ago

> Could a website that has a keylogger in it potentially pick up these keystrokes Yes of course. All it takes is misclicking and having the focus on a wrong window, and you're toast.

haquistiona 9y ago
Can you explain this more? What do you mean by "focus"?
- notzorbo3 9y ago
  By "focus" i mean the current window on your desktop that has the focus, as in, the one that's going to receive the input you give through your keyboard. I've seen plenty of people (and it's happened to me too) fumble and accidentally type or paste things in the wrong window. If that window happens to be your browser on a website that does this kind of tracking, that information goes to some random third party instead of the window you thought it was going to.

danenania 9y ago

The risk is actually the other way around. A page can't access data in an extension, but extensions with full permissions (most of them) can access anything on any page. Hacking a popular extension is one of the easiest routes to fully compromising millions of users (and every account they own). People are generally unaware of this danger, but it's much worse than ads or tracking.