Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TouchEn nxKey: A keylogging anti-keylogger solution

palant.info

Post reply on HN
Print view View original

51–60 of 60 posts

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#51

Post by lxgr »

From the article:

> The current approach is for the websites to use WebSockets API to communicate with the application directly.

Is this really current best practice? I know of a handful of applications that implement webapp to native app communication like this, but it doesn't seem especially stable/portable to me, considering that it usually uses some ephemeral port that applications have no way of globally reserving.

Also, how does HTTPS work in this scenario? Wouldn't there be a self-signed certificate or mixed content warning in many cases?

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#52

Post by tlranfdnjsror »

palant wrote: post #44
tlranfdnjsror wrote: post #37

@palant: Probably just some minor temporary weirdness but > Host palant.info not found: 3(NXDOMAIN)

I was transferring the domain to a new provider, and the old provider decided to drop the DNS entries before the transfer was completed. Great service. :-/

ah, good to know! well, it seems you left a not-so-good place:-)

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#53

Post by fomine3 »

jeroenhd wrote: post #15
ThrowAgain wrote: post #7

Between this and https://en.wikipedia.org/wiki/Shutdown_law South Korea sounds like pretty oppressive country to live in.

It depends on what you consider oppressive. In terms of international freedom indices, South Korea is about as free as the United States of America ( https://freedomhouse.org/countries/freedom-world/scores or https://rsf.org/en/index ) or not far from it ( https://worldpopulationreview.com/country-rankings/freedom-i... ) Of course this doesn't say much if you don't consider the USA to be a very free country but I'd r…

I wonder how SK ranked high despite they do much internet censorship https://en.wikipedia.org/wiki/Internet_censorship_in_South_K...

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#55

Post by palant »

lxgr wrote: post #51

From the article: > The current approach is for the websites to use WebSockets API to communicate with the application directly. Is this really current best practice? I know of a handful of applications that implement webapp to native app communication like this, but it doesn't seem especially stable/portable to me, considering that it usually uses some ephemeral port that applications have no way of globally reservi…

Disclaimer: I am the author of this article.

All applications I’ve looked into so far were communicating via a local web server. It wasn’t always WebSockets, one would also see JSONP or even submitting data to a frame.

They typically run the server on a fixed port. Port conflicts are rare in practice, so these applications don’t really care. In one case I’ve seen port probing however: if one port fails, websites will try to connect with subsequent ports.

As to best practices: I wouldn’t consider websites communicating with local applications best practice at all, by whatever means. It’s generally something to avoid.

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#56

Post by palant »

fomine3 wrote: post #54

eval() is banned on Firefox Addon, that could be a reason why they stop using.

Disclaimer: I am the author of this article.

Yes, default Content Security Policy of add-ons doesn’t allow eval(), and they likely couldn’t figure out how to change it. So it might be that they never even realized the security impact of these changes, which makes it even worse.

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#57

Post by snvzz »

It is interesting to see a proprietary, very poor and insecure imitation of Nitpicker's xray mode[0].

Note this is written by Norman Feske, who later went on to develop Genode[1], and continues to be its main developer today.

0. http://demo.tudos.org/nitpicker_tutorial.html

1. https://www.genode.org/

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#58

Post by palant »

snvzz wrote: post #57

It is interesting to see a proprietary, very poor and insecure imitation of Nitpicker's xray mode[0]. Note this is written by Norman Feske, who later went on to develop Genode[1], and continues to be its main developer today. 0. http://demo.tudos.org/nitpicker_tutorial.html 1. https://www.genode.org/

Disclaimer: I am the author of this article.

Not really the same thing from what I can tell. Nitpicker is merely about isolating processes from each other, making sure keyboard input is only received by the currently focused process. Windows already does that, and so does Wayland in my understanding.

The goal here seems to be rather stopping applications with sufficient privileges to install a system-wide keylogger. Which Nitpicker likely solves implicitly – by providing an OS that isn’t exactly flexible in what it can do, meaning that security was bought by sacrificing usability.

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#59

Post by snvzz »

palant wrote: post #58
snvzz wrote: post #57

It is interesting to see a proprietary, very poor and insecure imitation of Nitpicker's xray mode[0]. Note this is written by Norman Feske, who later went on to develop Genode[1], and continues to be its main developer today. 0. http://demo.tudos.org/nitpicker_tutorial.html 1. https://www.genode.org/

Disclaimer : I am the author of this article. Not really the same thing from what I can tell. Nitpicker is merely about isolating processes from each other, making sure keyboard input is only received by the currently focused process. Windows already does that, and so does Wayland in my understanding. The goal here seems to be rather stopping applications with sufficient privileges to install a system-wide keylogger.…

>making sure keyboard input is only received by the currently focused process.

Yes. This guarantee is of course only possible due to the operating system underneath supporting the whole thing; No capability to the keyboard means no keyboard access.

>by providing an OS that isn’t exactly flexible in what it can do

While this was somewhat true about TUD:OS, note that Genode is very different.

Particularly, Sculpt[0] provides a dynamic scenario for Genode, where programs can be launched and stopped, installed and removed, without giving up the properties the use of capabilities thorough offer.

Besides offering virtual machines as a way to get around its own limitations, it does currently support sound, accelerated graphics and enough POSIX butter to run a webkit-derived browser without relying on e.g. a Linux VM.

0. https://genode.org/download/sculpt

Re: TouchEn nxKey: A keylogging anti-keylogger solution

#60

Post by shard »

AYBABTME wrote: post #25
ThrowAgain wrote: post #22

Earlier quoted context omitted.

Wait, is this typical to had PA system in your apartment controlled by your landlord there? Can you tell more about this? I'm genuinely interested.

Wasn't controlled by the landlord, but by the management team which is paid by the condo fee. If you own the condo, you pay that fee, if you rent it from a landlord you also pay it. The management team I believe is hired by the residents committee which is elected by the residents. Sort of like an HOA, I guess? There were elections during my stay and we were invited to participate, but I didn't care enough and this w…

It was very interesting to me that South Korea is a high trust society in terms of crime (cash boxes left unattended, bicycles unlocked, people feel safe to walk the streets alone late at night), however it is very tribal and low trust in terms of providing assistance (less help provided to strangers in the streets compared to the US.. I've had to step in multiple times as I noticed that local Koreans were not helping). Maybe it's a big city thing (above experiences were in Seoul).
Post reply on HN