6 ms·

Yeah and the keylogger part is at least stretching the truth.

• ellimilial 5y ago
  "There are other reasons for key logging, such as providing autocomplete functionality" - I don't think they're stretching anything.
  • spzb 5y ago
    I think "keylogger" implies that keystrokes outside of your interaction with the webpage can be logged. This doesn't seem to be the case here.
    • hvdijk 5y ago
      That's not what they mean by "keylogger" and some reasonable people would agree with them on their naming. Suppose you have a log-in page, and a user name field, password field, and a "Log in" button. If a website secretly submits everything entered into the password field even when "Log in" isn't clicked, such as when a user accidentally pastes a password for another website and realises it before logging in, I think most people would call that a keylogger. In Gitlab's case, it seems to be their search function. It provides search results without needing to press Enter or clicking a button. From a technical POV, this is the exact same kind of keylogging as the above, it's only the intent that makes this okay and the above not so.
      • _flux 5y ago
        Would you agree that keylogger is a term for malicious software with the purpose of stealing private data such as credentials? Is this is the case, then the latter is not keylogging. The former is some sort of logging, but I wouldn't call it keylogging; after all, you are still entering data to the particular filed intended for entering credentials, to be sent to the remote server for verification. If the purpose of the remote server is something more nefarious, then it is keylogging. The feature would even make sense if the server would let you in without pressing enter; but for understandable reasons this is not really a thing..
        • hvdijk 5y ago
          > Would you agree that keylogger is a term for malicious software with the purpose of stealing private data such as credentials? No, I would not. Keylogger, I would say, is what the name implies: is a term for software that records keystrokes. In order for the term to be useful we have to limit it to such software where the recording is not obvious to the user, as otherwise even Notepad would count, but we do not have to limit it to malicious software.
          • _flux 5y ago
            So, basically, Google Docs is a keylogger? Would that go along with the common consensus, or perhaps water down the term to near meaningless? Maybe Firefox is keylogging my input as well; and in fact, so is Linux. Keyboard itself, definitely. Once I had X11 enter old keystrokes (so it had missed the read position in the input ring buffer and every stroke entered a key from the past); keyloggers all around. Kidding aside, I believe it is important to use terminology all parties agree on; after all, words are a tool for communicating. Even if an individual finds a deeper or "fundamental" meaning in a word outside the typical use of a word, attempting to use and understand it in such a way hinders communication.
            • hvdijk 5y ago
              Agreed, if there is consensus on what a word means it's unnecessarily distracting to use it in a different sense. In this case, the common meaning of keylogger is not restricted to malicious software, so we shouldn't insist here that it is.
              • ChrisLomont 5y ago
                >the common meaning of keylogger is not restricted to malicious software Over 99% of the hits on a google search use keylogger restricted to malicious software (sampled the first dozen or so pages). The first sentence in Wikipedia is "Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware that their actions are being monitored". The top definition googling a definition is "a computer program that records every keystroke made by a computer user, especially in order to gain fraudulent access to passwords and other confidential information." What metric did you use to conclude that the "common meaning" is not this common meaning? Not a single place I have found claims the common meaning is anything other than surreptitiously recording user keystrokes for nefarious purposes. Do you have even one such link?
      • DougBTX 5y ago
        The technical difference would be that a keylogger logs keystrokes regardless of where the focus is, whereas normal "respond to key events" logic would be restricted to capturing key events in a field where the user understands the focus to be. "Type to search" is OK, as the key events processed are restricted to the ones typed into the search field. A key logger would attach an event listener to capture key presses in any field, or even if no field is selected. It is the same technical difference between a UI which has an explicit "paste" button, which reads from the clipboard only when that button is pressed, vs a web app which reads from the clipboard indiscriminately, in the off-chance that there's something interesting (a password for a different website?) stored in the clipboard.
      • manigandham 5y ago
        A real keylogger would see CTRL+V not your password. This isn't logging keystrokes. Reasonable people wouldn't call it a keylogger because they assume that a form input will actually receive what you input.
        • hvdijk 5y ago
          > A real keylogger would see CTRL+V not your password. Fair point, though that's more of a corner case. > Reasonable people wouldn't call it a keylogger Not a fair point. If your starting assumption is that everyone who disagrees with you is unreasonable, please take a moment to reflect.
          • manigandham 5y ago
            You also said "reasonable people". I'm using the same term. Take a moment to read your own post.
            • hvdijk 5y ago
              I specifically said "some reasonable people" to allow for the possibility that other reasonable people could come to a different conclusion.
              • bobthechef 5y ago
                ...which implies there exist unreasonable people. In common speech, qualifiers are added when there is a need to distinguish. You wouldn't say "some people with brains" unless there existed brainless people and there was a need to distinguish them from the other.
              • manigandham 5y ago
                If both conclusions can be reached by "reasonable" people then that term is contextually meaningless. Why argue semantics when your own usage is irrelevant? And I stand by my position that considering an autocomplete to be a keylogger is unreasonable because the obvious purpose of the input is to accept you what you type. Automatically submitting may be a slight surprise but doesn't change the intent as you wouldn't type in the box if you were never going to submit it anyway.
      • jfrunyon 5y ago
        Their search function should simply be using an oninput or onchange event on a particular element, not global input. That is a technical difference.
• amiga 5y ago
  Today, I learned the awesome bar is a keylogger to some individuals.
  • Gravyness 5y ago
    What's an awesome bar?
    • belltaco 5y ago
      I think it's the Firefox web address field when it was retooled to show search suggestions as you type.
  • JohnHaugeland 5y ago
    1. Collects all keypresses 2. Sends them over the network Yes, actually, it is. Besides, the tracker explicitly points this out as a possibility.
• luke2m 5y ago
  A third party I’ve never heard of capturing keystrokes? Suspicious to me.
  • gcbirzan 5y ago
    Hotjar is one of the biggest players in the market of tracking user interactions with the site. Now you've heard of them. Are they any more trustworthy?
  • BTCOG 5y ago
    Agreed. Seems that some of the engineers commenting here work on projects in which they would have us believe a narrower description of what keylogging actually is, because they implement shady keylogging in their own products and need to feel better about it. If I don't press a submit button, and you are fielding my keystrokes into your database at any point, you are keylogging. I would not purposely use any product, or chat window, or form that I knew was submitting my keystrokes to their backend. If there is a button to send the form, only then should it be sending anything to your server. But this is hardly surprising these days with how entirely out of hand all the total data capture scope in products has been heading.