Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A CSS Keylogger

github.com

Post reply on HN
Print view View original

171–173 of 173 posts

Re: Show HN: A CSS Keylogger

#171

Post by sachleen »

Manishearth wrote: post #168
myfonj wrote: post #146

To some limited degree (you can detect presence, not position or number of occurences of character), you can do CSS only 'keylogging' even for non-reactive (sans JavaScript) input: you don't have to use attribute selector (which does't work without physical updates), but can exploit webfont with single letter `unicode-range` chunks. Posted it [1] to CrookedStyleSheets [2] some time ago: css keylogger @font-face { fon…

This will not work with password fields.

Then there's always this: https://www.troyhunt.com/bypassing-browser-security-warnings...

Re: Show HN: A CSS Keylogger

#172

Post by benatkin »

baddox wrote: post #165
insin wrote: post #164

Earlier quoted context omitted.

You can still capture an uncontrolled input's data `onChange` and `onBlur` for validation, password strength checking, later submission etc., you just don't reflect it back into the input on every render. The only thing it affects is your ability to change the input's data via a state change, but for a password field would you ever want to do anything but get its current value or clear it?

You’re right. With a little effort you could create reusable React form fields that are not controlled but which communicate their value/blur/etc. back to React for validation purposes. And yes, for password inputs, I can’t think of a case where you would absolutely need to control the value via React. Things like password confirmation validation and password strength indicators can be implemented via onChange and on…

I think the doc ought to be updated to say that you shouldn't make a password field a controlled component, and maybe even warnings added if you set value at all.

Re: Show HN: A CSS Keylogger

#173

Post by xab9 »

endless1234 wrote: post #159
xab9 wrote: post #103

Earlier quoted context omitted.

Technically yes. You can see it in the network panel.

Not at all. Sending off requests is a different thing entirely to controlled inputs, and you don't need a controlled input to do a request every keypress.

Damn you're right. Thanks!
Post reply on HN