News for hackers. Stuff that matters.

A comment on User tracking inspection result for about.gitlab.com.

Re:User tracking inspection result for about.gitlab.com by cyberlab on Tuesday April 27, 2021 @08:41AM (#26955075)
I always wondered about JS-powered keyloggers. What if you type your Linux admin password, or other sensitive things by accident into the webpage and it all gets scooped up? Yes: the keylogger would have a privacy policy in place, but it irks me to think I could accidentally reveal my dearest secrets into some nosy webpage.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by arecurrence on Tuesday April 27, 2021 @08:58AM (#26955249)
An even creepier analog to this was a big problem in mobile apps until Apple squashed it by telling everyone when it happens. Mobile apps were recording the clipboard every time they gained focus and many then uploaded that to the web. Copy pasted passwords... email addresses... etc.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by cyberlab on Tuesday April 27, 2021 @09:28AM (#26955525)
Yes, pasteboard scraping and exfil was rampant prior to Apple's new prompts.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by viraptor on Tuesday April 27, 2021 @09:14AM (#26955391)
Ideally it shouldn't matter that it happens. I mean, it's not great and if you're aware of this, you should roll your password, but realistically the external services should have no way to interact with your admin account.

For better protection you can use totp codes or some type of security token which makes password leaks useless.

[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by iamacyborg on Tuesday April 27, 2021 @08:48AM (#26955148)
This, but with everyone using Grammarly which is effectively a keylogger browser extension.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by jfk13 on Tuesday April 27, 2021 @08:53AM (#26955205)
Fortunately for me, Grammarly has so alienated me with its relentless, irritating ads that there is no possibility that I will ever install it.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by Kelamir on Tuesday April 27, 2021 @09:26AM (#26955497)
I've found LanguageTool(https://languagetool.org/) superior overall. It's open-source and is recommended by Firefox.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by googillionaire on Tuesday April 27, 2021 @08:45AM (#26955120)
There are other ways that could happen, too, for example a chat window or a search bar.

Change your password asap.

[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by gspr on Tuesday April 27, 2021 @08:49AM (#26955152)
And if you're running X: any window can just decide that it wants your keystrokes anyway.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by cyberlab on Tuesday April 27, 2021 @08:58AM (#26955247)
Yes that's what I forgot to mention. Windows can steal focus and you could accidentally spill secrets into them
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by gspr on Tuesday April 27, 2021 @09:15AM (#26955398)
With X they don't even need to steal focus. They can just copy all the keystrokes. Wayland fixes this.
[ Parent | on HN ]
Re:User tracking inspection result for about.gitlab.com by Ueland on Tuesday April 27, 2021 @09:10AM (#26955345)
I often think about this when I see services that does stuff with your input to help you. For example online JSON formatters, online RegEx testers and such.
[ Parent | on HN ]