22 ms·

It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that

It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(

vorpalhex 4y ago
If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.
- duxup 4y ago
  I feel like at that level of skepticism you're well on your way to the "just copy and paste" kind of thing. I think that advice is kinda horrible / difficult, but I think we're at that level where not much would assure you that X or Y isn't happening anyway.
  - vorpalhex 4y ago
    I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forget that requests tend to be logged by infrastructure. This happens enough to get it's own CWE - https://cwe.mitre.org/data/definitions/532.html https://cwe.mitre.org/data/definitions/532.html Copy and paste won't help you here. This usually happens on focus changes and frequently is done not as part of form submission but to see if people bounce from the page and for stats - meaning it goes to a less secured database and usually has widely available access to it. The fix here, in my opinion, is a mixture of technical (browsers aggressively disabling this sort of thing) and legal (penalizing accidental disclosures heavily). As a user, you can't do much.
- mattnewton 4y ago
  > You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs. I mean, yes, this is the internet we're talking about. I think this discussion is breaking down because keylogger = surreptitious, like when you are being logged by a third party when typing to a second party (ie you type a Google search into google.com and person who is not Google listens and logs that). It would be weird to describe you performing a search on Google as keylogging, though Google used to "transmit your keystrokes through several log keeping machines" to get auto-complete working

It’s really hard to have a meaningful discussion if we’re warping the definitions of words so much that “keylogger” now means something other than “a thing that logs keys” :(

vorpalhex 4y ago

If you are sending my keystrokes server side.. and your server has logs (as servers tend to do), don't you think you might be logging my keystrokes? You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs.

duxup 4y ago
I feel like at that level of skepticism you're well on your way to the "just copy and paste" kind of thing. I think that advice is kinda horrible / difficult, but I think we're at that level where not much would assure you that X or Y isn't happening anyway.
- vorpalhex 4y ago
  I think, especially in an age of heroku/lambda/etc, we can assume requests are logged by infrastructure. It is a trivially easy mistake to make - most devs forget that requests tend to be logged by infrastructure. This happens enough to get it's own CWE - https://cwe.mitre.org/data/definitions/532.html https://cwe.mitre.org/data/definitions/532.html Copy and paste won't help you here. This usually happens on focus changes and frequently is done not as part of form submission but to see if people bounce from the page and for stats - meaning it goes to a less secured database and usually has widely available access to it. The fix here, in my opinion, is a mixture of technical (browsers aggressively disabling this sort of thing) and legal (penalizing accidental disclosures heavily). As a user, you can't do much.
mattnewton 4y ago
> You are literally transmitting my keystrokes through several log keeping machines, to a piece of software that probably keeps logs. I mean, yes, this is the internet we're talking about. I think this discussion is breaking down because keylogger = surreptitious, like when you are being logged by a third party when typing to a second party (ie you type a Google search into google.com and person who is not Google listens and logs that). It would be weird to describe you performing a search on Google as keylogging, though Google used to "transmit your keystrokes through several log keeping machines" to get auto-complete working