4 ms·

I felt like you did, and watched the video and he is certainly looking at an HTTPS data stream. I think the argument though is that the request is being logged

I felt like you did, and watched the video and he is certainly looking at an HTTPS data stream. I think the argument though is that the request is being logged and that some employee is reviewing logs and grabbing data. If that is the case, then it seems there is a known pool of suspects to charge with theft...

ceejayoz 8y ago
Yeah, and the amount of data to sift through there would be truly enormous. I'd wager there was just some malware on the machine.
- SketchySeaBeast 8y ago
  Apparently it's a list of 12 words from 2048. I guess you could potentially try and pattern match that, but that'd be a ton of a sifting.
- Phlarp 8y ago
  The amount of data to sift through? What website am I on right now? Just grep for 64 character strings. The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
  - ceejayoz 8y ago
    The stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.) I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed. Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.
    - Phlarp 8y ago
      Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.
tbodt 8y ago
Access to this data is very tightly controlled, it's likely a single digit number of people.

ceejayoz 8y ago

Yeah, and the amount of data to sift through there would be truly enormous. I'd wager there was just some malware on the machine.

SketchySeaBeast 8y ago
Apparently it's a list of 12 words from 2048. I guess you could potentially try and pattern match that, but that'd be a ton of a sifting.
Phlarp 8y ago
The amount of data to sift through? What website am I on right now? Just grep for 64 character strings. The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
- ceejayoz 8y ago
  The stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.) I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed. Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.
  - Phlarp 8y ago
    Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.

tbodt 8y ago

Access to this data is very tightly controlled, it's likely a single digit number of people.