> calling server-side autocomplete on a field you explicitly are typing in strikes me as about as sensible and forthright as calling an Amazon text field that takes my credit card number a card skimmer

Exactly, and waters down the impact of the termminology. If "card skimmer" is anything that can read a credit card, than the term is meaningless for security.

If "keylogger" is anything connected to the web that responds to a keypress...

GNU is risking turning into the boy who cried wolf here.

> GNU is risking turning into the boy who cried wolf here.

As with a lot of the FSF's messaging, I think the substance of the message may be correct, but the way they convey it just isn't effective.

If this is for a general audience(!), no-one was ever convinced by the 48th item in a list who wasn't already convinced by the 47th. You don't persuade people just by being right, and certainly not by banging on about the very many subtly-different ways in which you're right. Pick few strong examples and prosecute those decisively.

If this is a resource for campaigners, set out the audience and intent before you start. Preface it with something like “Here are various ways that certain aspects of Google's software can be seen as indistinguishable from malware. They may be useful counterarguments if someone suggests Google's software is trustworthy.”

There's a lot to appreciate about Stallman, but as an ideologue, he's never going to prioritize a gentle & incremental articulation of his ideas. We could call it a failure to empathize, but you see ideologues all over undermining their communication by making it as distilled & radical as possible. But that's not what tends to convince other humans they're wrong about something.

How about an Amazon text field that takes your credit card number before you submit the form?

There's no warning that a text field autocompletes, and no reason to assume all users are tech savvy enough to realize that google has to see every character typed to send back recommendations.

There are keyloggers targeted to specific fields too. It depends on what vulnerability is being exploited to install a keylogger.

I think the description of autocomplete as a keylogger is a good fit from the security perspective.

No, as a keylogger is the term for a malware to capture ALL your keystrokes in secret (to usually later fish out the interesting ones like passwords). It is misleading, to mix it up with a software, that captures your textinput from a textfield, even though it is not communicated clearly to the average user that his text goes to a server.

If the text field sent everything you type but didn't autocomplete, it would be spyware.

Autocompleting doesn't change that.

The Amazon text field would have to send your credit card number for a credit check without telling you to compare.

The autocomplete provides a valuable service: it shows you suggestions for search terms; it's similar to if the credit card number is sent to the server and the server sends back whether or not the number is a valid credit card number (although this is now done on the client side).

It can also be turned off extremely easy, not exactly what we know as "malware" if it allows you to turn off its "malicious" activities.

>I'd naively consider a keylogger to be software that captures your keypresses universally.

On Windows asking for a handler for all key presses will often trigger the antivirus, while asking for a single application often will not.