151–160 of 174 posts
Earlier quoted context omitted.
But Google Wave was up front about it, and both parties can see what each other is typing.
Not only that, but "talk" on Unix had that for 20+years before that.
Earlier quoted context omitted.
Had this happen about 2 weeks ago when I was booking a hotel. This was not a chat window, like the article, but a hotel booking form. I had a few tabs open and filled in the booking information but found something a little more convenient. So, I did not submit the form and closed the tab. About 2-3 minutes later my phone started to ring. It was a customer service agent from that incomplete booking website asking if I…
This is old news. It's fairly easy to implement and most often done with simple google sheets.
Earlier quoted context omitted.
Having your password manager integrate with your browser is one of the best defenses against phishing, though. It will only fill the password if the origin matches.
... or if there's a bug, or if the bridge from the extension to the page content has a mistake that lets javascript on the page control it. That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake. some linky links: https://twitter.com/taviso/status/941711305668411393 http…
1Password wrote an extended post in response to that vulnerability talking about defenses and threat models https://discussions.agilebits.com/discussion/70301/backgroun... and I don't see evidence that the vulnerability ever recurred.
And it was not a threat that allowed one website to get passwords for another website. It's true that other password managers have had such vulnerabilities - multiple times - but that's a reason to comparison-shop the various password managers and pick a secure one, not to write off the product category entirely.
The general public is at least 20 years behind in understanding of what the tech does.
And the general public is about 100+ years behind in understanding of physics
Is there a browser extension that lets you forbid websites to intercept your keyboard and mouse keystrokes without disabling JavaScript completely?
Wouldn't pausing and resuming JavaScript have the same effect?
Earlier quoted context omitted.
> "why didn't we do this earlier?" Because it's invasive. The user consents to sending you information when they hit Send(explicit). They can remove any incorrect or unrelated information from the text box before they do so. Especially if they paste in to the text box and inadvertently paste the wrong thing(be that sensitive info or similar).
I use a chat service that has this feature on by default (for real-time chat customer support, not for general messaging), and never in the history of its usage has a person complained about it. For every 10,000 people that may not have an issue with it, 1 may have an issue about it, and with these numbers it's really up to that 1 person to guard their privacy better (disable JS, never step outside their house, etc)…
How would most people know to complain about something they don't know is happening?
Earlier quoted context omitted.
I think a lot of it has to do with consumer expectations. We can all sit here and laugh and act unsurprised, but technology has conditioned users that the response isn't sent until you press "Send". Its bad (and I'd argue harmful) UX. Imagine this scenario: Copying and pasting a debug log, realizing it contains personal or important information (such as password, SSN, or anything else) and it is sent to the agent bef…
I think you're right. I also think the browser, as your agent, should enforce expectations. "This website wants to upload data. Allow? [Once] [Always] [No] [Click here to see the data.]"
I wish that it was more prevalent for people to just assume and know that any website, regardless of whether or not it has a chat function, has the ability to record what you're saying (read: typing). Everyone out there should act like everything they type into their web browser has the potential to be seen by, at the very least, the website they're typing it on and, at worst, by everyone online. If you really need t…
If the site is using SSL, there is a reasonable expectation that only the server will see that data, not the entire world.
Earlier quoted context omitted.
This is old news. It's fairly easy to implement and most often done with simple google sheets.
Think you can give a short example code?