4 ms·
Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle. Assuming that's how 1Password works, it should be safe. I think
by qeorge 14y ago
Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle.
Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.
- bockris 14y agoBut isn't that in itself another vector to 'hook' and redirect (just like the keystokes and clipboard)? I'm going to agree with jiggy2011. Once you are compromised at that level then it's pretty much game over.
- deleted 14y ago[deleted]
- qeorge 14y agoDefinitely. I meant that it probably didn't use the clipboard or keyboard emulation, and so it would be safe from those particular attacks. Didn't mean to imply it would be safe from everything. To nitrogen's point, there's definitely a corresponding GETTEXT message. There's even hooks[1]. But that's about all I know. Haven't written a desktop app in > 10 years. [1] http://msdn.microsoft.com/en-us/library/ms644990%28v=vs.85%29.aspx http://msdn.microsoft.com/en-us/library/ms644990%28v=vs.85%2...
- nitrogen 14y agoIf you can SET_TEXT, you can probably also get text. I've heard stories of win32 "password stealers" that constantly loop through all the window handles on the system looking for password fields, and if one is found, they log the contents of all nearby text fields (to get the username) and the password field to a file.