Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I reverse-engineered Google Docs to play back any document's keystrokes

features.jsomers.net

Post reply on HN
Print view View original

71–80 of 121 posts

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#71

Post by userbinator »

traek wrote: post #66
userbinator wrote: post #63

This is one of the reasons why it's great that the source code of web pages/apps is (relatively, compared to binaries) easy to reverse-engineer - because of their environment inside a browser, web apps have such a low barrier to "phoning home" and making requests that privacy-sensitive information being leaked may otherwise be difficult to notice. Imagine if they were all encrypted/obfuscated binaries... I don't use…

When you say that "privacy-sensitive information" is "being leaked", you make it sound much worse than it is. The information being sent seems completely normal for an online word processor with a revision history, and it's not being "leaked" to anyone besides the company providing the word processor.

The information being sent seems completely normal for an online word processor with a revision history

When most people hear "revision history", they think of the versions of the document that exist between explicit saves or periodic autosaves, and not extremely fine-grained per-keystroke activity logging.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#72

Post by relate »

mintplant wrote: post #70

Didn't Google Docs used to have this "playback" feature built in? I clearly remember there being a slider at the top of the page that you could scrub back and forth through a document's revision history.

I remember that from Google Wave at least.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#73

Post by marknadal »

Great article, fascinating.

The author mentions that his system doesn't handle rich text, which is fine, but I'd just like to comment on how difficult of a problem handling rich text is. If anyone is interested in having a personal text-only replay editor, check out http://sharejs.org/ by an ex-Google Wave engineer.

As far as handling rich text, I've talked to the original co-founders of Writely (which became Google Docs), and I've also spent a good 8+ months on it as well. There are lots of tradeoffs involved, that diff-patch-match (as mentioned in the article) won't work on. Doc's ultimately expresses styles as applied ranges, rather than actual markup.

Point being, Google keeping every keystroke you've made is absolutely necessary for realtime collaborative writing.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#74

Post by mutagen »

r00fus wrote: post #35
michaelx386 wrote: post #26

I broke out in to a cold sweat watching this as I remembered all the times I've inadvertently pasted sensitive stuff in to a document. It's still very cool though, I'll just need to remember to be careful when sharing documents.

I wonder how much sensitive information is inadvertently pasted into a browser location bar or autofill text box that's silently captured by web apps like Google Docs? I know I've accidentally done the "paste password" into those places accidentally at times.

My browser URL bar has received a few passwords, usually just a local computer password but occasionally something more sensitive. Makes me wonder about the permissions my collection of browser addons has.

I've also chucked a few passwords into IRC in times past. Fortunately non-essential stuff but really motivated me to sort out some better solutions (SSH keypairs, etc).

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#76

Post by dbarlett »

character0 wrote: post #6

The creation story for this is really neat. This could be an amazing tool in the school setting, especially for people that teach in university writing centers. This isn't just asking an author for a peek behind the curtain, asking a few questions about what they were thinking at the time of writing, this is Breaking the Magician's Code level stuff! I am curious to see who is (brave enough?) to show their writing pro…

pg: http://paulgraham.com/stypi.html

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#77

Post by jaredmcateer »

tlb wrote: post #23

Interesting -- I would not have guessed they were storing all our keystrokes. It'd be fascinating to mine that data, for example, to find patterns of typos.

Anyone that has used the multi-user collaborative editing should not be surprised that at the very least your keystrokes are regularly being transmitted to Google for playback on other people's computers. It's not so much of a leap to assume that they are also stored given Google's lust for data.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#78

Post by zaroth »

yzzxy wrote: post #67
6stringmerc wrote: post #45

Clever, very clever. As somebody who has worked full-time, over-time, and essentially in my sleep with Word files, PowerPoints, and highly sensitive bid documentation...yeah, I have to agree working in the cloud for this kind of stuff strikes me as career suicide. Maybe not in your turf, re: software development, but with respect to management, operations and marketing people, there should only be one person with the…

Even if you are working on something that is not security/negotiation sensitive, this is still scary, and the layman can approximate it with Google docs document history and the like. Document history enables thoughtcrime detection, especially as it becomes more and more atomic towards actual keystrokes. I wonder how long it will be until typed and deleted text is used as evidence in a court of law.

As I recall the Steve Jobs / Apple wage collusion lawsuit used Steve's auto-saved draft emails to show intent.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#79

Post by hunter2_ »

mutagen wrote: post #74
r00fus wrote: post #35

Earlier quoted context omitted.

I wonder how much sensitive information is inadvertently pasted into a browser location bar or autofill text box that's silently captured by web apps like Google Docs? I know I've accidentally done the "paste password" into those places accidentally at times.

My browser URL bar has received a few passwords, usually just a local computer password but occasionally something more sensitive. Makes me wonder about the permissions my collection of browser addons has. I've also chucked a few passwords into IRC in times past. Fortunately non-essential stuff but really motivated me to sort out some better solutions (SSH keypairs, etc).

Plenty of times I've come back to my computer, typed my OS password expecting that it was locked, waited for my display's turn-on lag, and found that it wasn't locked (grace period). I type the password blind, but reserve the enter until I have visual feedback.

At least typical IRC clients don't transmit until hitting enter. Browser omnibars and Javascript can send away every keystroke as it happens. Now I want to search all my Google Docs for my passwords -- let alone other stupidity I don't care to share.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#80

Post by r00fus »

hunter2_ wrote: post #79
mutagen wrote: post #74

Earlier quoted context omitted.

My browser URL bar has received a few passwords, usually just a local computer password but occasionally something more sensitive. Makes me wonder about the permissions my collection of browser addons has. I've also chucked a few passwords into IRC in times past. Fortunately non-essential stuff but really motivated me to sort out some better solutions (SSH keypairs, etc).

Plenty of times I've come back to my computer, typed my OS password expecting that it was locked, waited for my display's turn-on lag, and found that it wasn't locked (grace period). I type the password blind, but reserve the enter until I have visual feedback. At least typical IRC clients don't transmit until hitting enter. Browser omnibars and Javascript can send away every keystroke as it happens. Now I want to se…

Is it me or is your userid ironically apropos to this discussion?
Post reply on HN