4 ms·
The amount of data to sift through? What website am I on right now? Just grep for 64 character strings. The regex is so simple I think it a little naive not t
by Phlarp 8y ago
The amount of data to sift through? What website am I on right now? Just grep for 64 character strings.
The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
- ceejayoz 8y agoThe stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.) I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed. Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.
- Phlarp 8y agoSure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.