5 ms·
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
by gsnedders 9y ago
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
- cag_ii 9y agoIt'd be simple enough to add an 'order' identifier (request timestamp, etc) to the requests. Edit: nm. My mistake, not as easy as that using only css!
- usrusr 9y agoSimple enough, in CSS?
- ateesdalejr 9y agoWhy would you even need an order identifier? All you need to do is check the request logs for your server everything should be already in order.
- cag_ii 9y agoI was replying to the comment above which pointed out correctly that the order in which the server receives the requests may differ from the order in which they were sent.
- regularhackerer 9y agoOr the user corrects a typo by moving the cursor or using backspace. However I think the idea is that the keylogger will work on some or most users.
- Francute 9y agoNot an efficient keylogger, however, if you know the pressed keys, you can just generate permutations ordered using probabilities, and that would be a lot faster than brute force. The real deal here is, it depends on some js code updating the dom for each key press, which is BAAAD. Not an useless keylogger, because it reminds a vulnerability product of choosing a bad decision.
- X-Istence 9y ago> it depends on some js code updating the dom for each key press Like React with JSX?
- tmerse 9y agoIt may be easier to XSS CSS than JS.
- netsharc 9y agoInterestingly the password "BAAAD" would generate 3 requests to the logging server, since it wouldn't request the background image for the letter "A" more than one time. Or shouldn't, anyway.
- early 9y agoThat depends on cache headers sent from the server, which the attacker controls
- plopz 9y agoEven if the attacker got them out of order, it would let them be able to brute force guess in a small number of attempts.
- hinkley 9y agoFor example, there are about 41,000 possible passwords for a given set of 8 characters, out of around 96^8 possible 8 character passwords (in the ASCII character set).
- brailsafe 9y agoWhere does 41000 come from?
- eterm 9y agoIt's 8! (8 factorial) which is 40320. This is 127,286,426,869 (~128bn) times smaller than 92^8. Edit: Note that if you have a repeated character in your 8 charcter password then the number of permutations of the set of 8 (7 distinct) characters is further halved to 20,160.
- Klathmon 9y agoAnd just by doubling the amount of selectors you could always check for a repeated character! (AKA [value$=aa], [value$=bb], etc...)
- roywiggins 9y agoAnd if any of those are words or almost words, you'd guess that first and probably have it.
- ohmatt 9y agoWell it would also not come in the correct order if someone types their password wrong, deletes letters and re-types them, etc. But I assume the idea would be that you'd have a much easier time figuring out the password if you had all the keys they pressed.
- spyder 9y agoYou can just add the two (or more) letter permutations to the CSS to help to identify the previous characters. ( like [value$="aa"] )