I don't think anyone is surprised, but it is still good to call out bad actors from time to time.

Whenever there's a story like this every hn response is "always assume you are being watched at all times!" - but nobody can maintain that kind of hyper vigilance forever, and it isn't a healthy way to live.

>I don't think anyone is surprised

I do. Nobody who goes on HN will be. But the layman who spends 80 hours a week working a minimum wage job who has no time for computers and just wants a Disney vacation for his kids, absolutely would be floored by this. It seems very reasonable to apply conventional logic to computers. You can write all you want on a piece of paper and then throw it away and nobody would see it. The same doesn't apply on the internet, but it's not a big leap for people who barely know how to log in.

> Nobody who goes on HN will be

I go on HN, and although I'm not surprised that this is possible, nor shocked that it's done, it is the kind of thing I could easily fail to think about, or assume is probably not actually being done by anyone I deal with.

I guess the analogy is that there is someone later on snooping through the trash. Yeah, it's creepy. No two ways about it.

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.

Having your password manager integrate with your browser is one of the best defenses against phishing, though. It will only fill the password if the origin matches.

... or if there's a bug, or if the bridge from the extension to the page content has a mistake that lets javascript on the page control it.

That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake.

some linky links: https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/769378052254015488

I've promoted password managers for a long time! Just not fancy convenient commercial ones, those are a huge mistake.

To my knowledge, 1Password (which is what I use) has never had one of these bugs. There is one flaw reported in the P0 bugtracker against 1Password, that another user on the same local machine running native code can trick the 1Password agent into believing that it's your browser extension https://crbug.com/project-zero/888 . All the machines where I run 1Password are single-user machines, so local processes running as other users aren't within my threat model anyway. (And I think this is 95%+ of people's threat models too on the machines where they run 1Password, although I understand why 1Password attempted to defend against this risk.)

1Password wrote an extended post in response to that vulnerability talking about defenses and threat models https://discussions.agilebits.com/discussion/70301/backgroun... and I don't see evidence that the vulnerability ever recurred.

And it was not a threat that allowed one website to get passwords for another website. It's true that other password managers have had such vulnerabilities - multiple times - but that's a reason to comparison-shop the various password managers and pick a secure one, not to write off the product category entirely.

Blocking intercom? Intercom doesn’t do creepy stuff.

Yes. Do all that stuff. You're still being watched at all times.

I don't think that the company "exposed" in the article is a bad actor. Seems like a helpful and reasonable thing to do.

If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.

Depends if that server is storing every conversation in a non password protected mongo database. I'm going to stick with expecting the entire world is going to see it until security and privacy is valued much greater then currently.

I disagree, assuming there are no other security holes (browser extensions, whatnot) then the server will initially receive it, but they can then forward that data to any third party they wish.

TLS has very little to do with it. Some intermediary parties may be able to read the plaintext, but that's different from putting it on pastebin for everyone to see. I've never heard of ISPs or transit providers publishing privacy-sensitive data or otherwise snooping on it. (Assuming non-business / non-VPN / non-proxy connections. Just an ordinary internet connection.)

The author probably meant if the site gets/is hacked, or if they are later bought by another company, or if a new employee joins and you can see chat history... etc.

Many high-profile commercial carriers will do deep packet inspection of the traffic from their end users, so that they can do insertion of their own ads into whatever content you may be surfing. Including on your webmail pages.

And their ad networks might well be infected with malware. But because of deep packet inspection and editing, you can't tell that the malvertising in question actually came from AT&T or Spectrum instead of Gmail.

I heard of one USA mobile carrier doing that at some point, but is it actually common anywhere on the planet? Even in the USA it seems to have been a one-off.

How are they able to do ad insertion into a https page?

I'm sure Google would not be happy with content injection into gmail.

Yeah,that doesn't make any sense, unless they're doing an MITM attack just to insert ads?

Although you're technically right, my point is more along the lines of people just being in the default state of skepticism. Be as secure as you, personally, can possibly be and just assume that everyone else isn't following standard security protocols, that their SSLs are invalid, and that they're monitoring what you're typing.

It's similar to the old adage about driving: "Drive like everyone else is an idiot out to kill you. Don't be right, be predictable."

Not really, because the site probably stores the data and the site could be breached, or they could sell (access to) the data.

Edit: In the worst-case, as per the GP's point.

Well you aren't wrong. I mean technically speaking if there is an SSL certificate, than in fact you are directly connected to the server and no one is in between.

The difference is that if I own the server, I can see your information even though it was a direct server connection. You directly fed the information to me. That is what is happening in these scenerios.

Nah, there are hundreds of CAs out there. People could get their SSL certs from any one of them and MITM all your supposedly secure web traffic.

And plenty of ISPs will do exactly that, if you give them half a chance.

Even in that case, what server? The server belonging to the url in the address bar? Or the one hosting that facebook icon? Or the one collecting the client-side metrics/analytics for the developers? Or the many serving you ads on that page?

If they log keystrokes (for security, UX research or whatever) there's a good chance that they send enough packets to allow an attacker to infer a lot just from observing frequency and length of packets.

Depends on what analytics and ad tracking are also running on that site