6 ms·

I'd naively consider a keylogger to be software that captures your keypresses universally. I use Firefox and have search suggestions disabled there so I am som

I'd naively consider a keylogger to be software that captures your keypresses universally. I use Firefox and have search suggestions disabled there so I am somewhat sympathetic to their point. That said, calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer.

aflag 7y ago
There are keyloggers targeted to specific fields too. It depends on what vulnerability is being exploited to install a keylogger. I think the description of autocomplete as a keylogger is a good fit from the security perspective.
- hutzlibu 7y ago
  No, as a keylogger is the term for a malware to capture ALL your keystrokes in secret (to usually later fish out the interesting ones like passwords). It is misleading, to mix it up with a software, that captures your textinput from a textfield, even though it is not communicated clearly to the average user that his text goes to a server.
davvolun 7y ago
> calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security. If "keylogger" is anything connected to the web that responds to a keypress... GNU is risking turning into the boy who cried wolf here.
- gregknicholson 7y ago
  > GNU is risking turning into the boy who cried wolf here. As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective. If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively. If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”
  - c0vfefe 7y ago
    There's a lot to appreciate about Stallman, but as an ideologue, he's never going to prioritize a gentle & incremental articulation of his ideas. We could call it a failure to empathize, but you see ideologues all over undermining their communication by making it as distilled & radical as possible. But that's not what tends to convince other humans they're wrong about something.
gcbw2 7y ago
consider the following example: You are going to visit example.com, a site which you have an account. You think your clipboard have the string "example.com". But while the browser opened, you clicked your password manager and already copied the password for it. (or for the sake of the example, you might have been typing an email you didn't not want to share, maybe it had financial information about your IPO... I am going with password as it is clearly something you want and need to keep private) When Chrome opens, you click the address bar and paste. See your mistake, press backspace a few types, type example.com and press return. Now google has on it's logs (and associated to your user profile) your example.com's password and you never had any feedback that it was sent, unless there was search results for your password (let's hope not)! Had you used firefox with autocomplete off (which you should) you would have seen the mistake before pressing return. or if you did press return, it would have been very clear to you that you just sent your password to google. So, defend it all you want, but it is a dark pattern that logs everything you type on a somewhat unrelated field and only show you feedback on certain cases. It is worlds apart from typing your credit card on amazon!
pessimizer 7y ago
How about an Amazon text field that takes your credit card number before you submit the form? There's no warning that a text field autocompletes, and no reason to assume all users are tech savvy enough to realize that google has to see every character typed to send back recommendations.
yarrel 7y ago
If the text field sent everything you type but didn't autocomplete, it would be spyware. Autocompleting doesn't change that. The Amazon text field would have to send your credit card number for a credit check without telling you to compare.
- judge2020 7y ago
  The autocomplete provides a valuable service: it shows you suggestions for search terms; it's similar to if the credit card number is sent to the server and the server sends back whether or not the number is a valid credit card number (although this is now done on the client side). It can also be turned off extremely easy, not exactly what we know as "malware" if it allows you to turn off its "malicious" activities.
fuzz4lyfe 7y ago
>I'd naively consider a keylogger to be software that captures your keypresses universally. On Windows asking for a handler for all key presses will often trigger the antivirus, while asking for a single application often will not.

aflag 7y ago

There are keyloggers targeted to specific fields too. It depends on what vulnerability is being exploited to install a keylogger. I think the description of autocomplete as a keylogger is a good fit from the security perspective.

hutzlibu 7y ago
No, as a keylogger is the term for a malware to capture ALL your keystrokes in secret (to usually later fish out the interesting ones like passwords). It is misleading, to mix it up with a software, that captures your textinput from a textfield, even though it is not communicated clearly to the average user that his text goes to a server.

davvolun 7y ago

> calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security. If "keylogger" is anything connected to the web that responds to a keypress... GNU is risking turning into the boy who cried wolf here.

gregknicholson 7y ago
> GNU is risking turning into the boy who cried wolf here. As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective. If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively. If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”
- c0vfefe 7y ago
  There's a lot to appreciate about Stallman, but as an ideologue, he's never going to prioritize a gentle & incremental articulation of his ideas. We could call it a failure to empathize, but you see ideologues all over undermining their communication by making it as distilled & radical as possible. But that's not what tends to convince other humans they're wrong about something.

gcbw2 7y ago

consider the following example: You are going to visit example.com, a site which you have an account. You think your clipboard have the string "example.com". But while the browser opened, you clicked your password manager and already copied the password for it. (or for the sake of the example, you might have been typing an email you didn't not want to share, maybe it had financial information about your IPO... I am going with password as it is clearly something you want and need to keep private) When Chrome opens, you click the address bar and paste. See your mistake, press backspace a few types, type example.com and press return. Now google has on it's logs (and associated to your user profile) your example.com's password and you never had any feedback that it was sent, unless there was search results for your password (let's hope not)! Had you used firefox with autocomplete off (which you should) you would have seen the mistake before pressing return. or if you did press return, it would have been very clear to you that you just sent your password to google. So, defend it all you want, but it is a dark pattern that logs everything you type on a somewhat unrelated field and only show you feedback on certain cases. It is worlds apart from typing your credit card on amazon!

pessimizer 7y ago

How about an Amazon text field that takes your credit card number before you submit the form? There's no warning that a text field autocompletes, and no reason to assume all users are tech savvy enough to realize that google has to see every character typed to send back recommendations.

yarrel 7y ago

If the text field sent everything you type but didn't autocomplete, it would be spyware. Autocompleting doesn't change that. The Amazon text field would have to send your credit card number for a credit check without telling you to compare.

judge2020 7y ago
The autocomplete provides a valuable service: it shows you suggestions for search terms; it's similar to if the credit card number is sent to the server and the server sends back whether or not the number is a valid credit card number (although this is now done on the client side). It can also be turned off extremely easy, not exactly what we know as "malware" if it allows you to turn off its "malicious" activities.

fuzz4lyfe 7y ago

>I'd naively consider a keylogger to be software that captures your keypresses universally. On Windows asking for a handler for all key presses will often trigger the antivirus, while asking for a single application often will not.