5 ms·

Your customers probably wouldn't love auto complete if they knew it was implemented as a key logger. Try doing it client side.

duxup 4y ago
>Try doing it client side Do what client side? Store all the auto-complete possibilities client side? I think that doesn't make sense. But my larger point is you can't tell for sure if it is a keylogger or just something else.
- vorpalhex 4y ago
  Nor does the difference matter to me as a user. If you're transmitting my keystrokes to your server.. it's a keylogger.
  - Shish2k 4y ago
    It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(
    - vorpalhex 4y ago
      If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.
      - duxup 4y ago
        I feel like at that level of skepticism you're well on your way to the "just copy and paste" kind of thing. I think that advice is kinda horrible / difficult, but I think we're at that level where not much would assure you that X or Y isn't happening anyway.
        vorpalhex 4y ago
        I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forget that requests tend to be logged by infrastructure. This happens enough to get it's own CWE - https://cwe.mitre.org/data/definitions/532.html https://cwe.mitre.org/data/definitions/532.html Copy and paste won't help you here. This usually happens on focus changes and frequently is done not as part of form submission but to see if people bounce from the page and for stats - meaning it goes to a less secured database and usually has widely available access to it. The fix here, in my opinion, is a mixture of technical (browsers aggressively disabling this sort of thing) and legal (penalizing accidental disclosures heavily). As a user, you can't do much.
      - mattnewton 4y ago
        > You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs. I mean, yes, this is the internet we're talking about. I think this discussion is breaking down because keylogger = surreptitious, like when you are being logged by a third party when typing to a second party (ie you type a Google search into google.com and person who is not Google listens and logs that). It would be weird to describe you performing a search on Google as keylogging, though Google used to "transmit your keystrokes through several log keeping machines" to get auto-complete working
- marcosdumay 4y ago
  You don't need to send queries that return very few results. Once you send a partial text that returns a few hundred results, any additional typing can be completely handled on the client side. If you only have a few hundred options at all, you don't need to send any text. That's just good software engineering, by the way. Autocomplete queries are quite expensive, you want to minimize them. But, of course, that won't stop sending data pasted in a single step. Anyway, the article isn't about auto-completing fields.
  - duxup 4y ago
    >Once you send At that point you're sending anyway ... I'm not sure someone seriously concerned about keylogging to the point that they object to auto complete cares if you send 5 or 6 characters. I think at that point you're addressing all your users on behalf of a few who are so concerned that they're not going to be happy with any "solution" outside turning it off altogether.

duxup 4y ago

>Try doing it client side Do what client side? Store all the auto-complete possibilities client side? I think that doesn't make sense. But my larger point is you can't tell for sure if it is a keylogger or just something else.

vorpalhex 4y ago
Nor does the difference matter to me as a user. If you're transmitting my keystrokes to your server.. it's a keylogger.
- Shish2k 4y ago
  It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(
  - vorpalhex 4y ago
    If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.
    - duxup 4y ago
      I feel like at that level of skepticism you're well on your way to the "just copy and paste" kind of thing. I think that advice is kinda horrible / difficult, but I think we're at that level where not much would assure you that X or Y isn't happening anyway.
      - vorpalhex 4y ago
        I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forget that requests tend to be logged by infrastructure. This happens enough to get it's own CWE - https://cwe.mitre.org/data/definitions/532.html https://cwe.mitre.org/data/definitions/532.html Copy and paste won't help you here. This usually happens on focus changes and frequently is done not as part of form submission but to see if people bounce from the page and for stats - meaning it goes to a less secured database and usually has widely available access to it. The fix here, in my opinion, is a mixture of technical (browsers aggressively disabling this sort of thing) and legal (penalizing accidental disclosures heavily). As a user, you can't do much.
    - mattnewton 4y ago
      > You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs. I mean, yes, this is the internet we're talking about. I think this discussion is breaking down because keylogger = surreptitious, like when you are being logged by a third party when typing to a second party (ie you type a Google search into google.com and person who is not Google listens and logs that). It would be weird to describe you performing a search on Google as keylogging, though Google used to "transmit your keystrokes through several log keeping machines" to get auto-complete working
marcosdumay 4y ago
You don't need to send queries that return very few results. Once you send a partial text that returns a few hundred results, any additional typing can be completely handled on the client side. If you only have a few hundred options at all, you don't need to send any text. That's just good software engineering, by the way. Autocomplete queries are quite expensive, you want to minimize them. But, of course, that won't stop sending data pasted in a single step. Anyway, the article isn't about auto-completing fields.
- duxup 4y ago
  >Once you send At that point you're sending anyway ... I'm not sure someone seriously concerned about keylogging to the point that they object to auto complete cares if you send 5 or 6 characters. I think at that point you're addressing all your users on behalf of a few who are so concerned that they're not going to be happy with any "solution" outside turning it off altogether.