4 ms·
This assumes the machine is already pwned - at which point why wouldn't they just use a keylogger? In that case, typing the password in without the use of a pas
by Nadya 8y ago
This assumes the machine is already pwned - at which point why wouldn't they just use a keylogger? In that case, typing the password in without the use of a password manager instead of copy/pasting from a password manager wouldn't be any more secure.
- vemv 8y agoIt's reasonably easy (or at least feasible) to sneak runnable code as an indirect dependency of a development project (node.js, rails, etc), or of a Homebrew formula. No pwning needed - at least as commonly conceived. Presumably, running `pbcopy` is easier and less detectable than writing a keylogger?
- bscphil 8y agoThis suggests a related question. There's no inherent reason why programs other than your desktop shell and the current focused window (for window based DEs) need to have access to keyboard input. In practice, how good are existing DEs at controlling this access? I know, for example, that the slow move from X to Wayland has removed some of the methods a program might use to access inputs or the clipboard.