Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I reverse-engineered Google Docs to play back any document's keystrokes

features.jsomers.net

Post reply on HN
Print view View original

111–120 of 121 posts

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#111

Post by morgante »

eplanit wrote: post #107
morgante wrote: post #85

I don't understand why most of the commenters here are focusing on the privacy implications rather than the technical aspects. Is this really a privacy breach? It's been obvious that Google stores revision history since it launched—you've always been able to access a thorough revision history in the UI itself...

I think the issue for some (including myself) is that this revelation shows that the vulnerability of a compromised document is greater than the apparent contents of the document. It includes all keystrokes, which could expose other ideas the writer might have had (but discarded), etc. This fact makes me even less inclined to use Google docs.

Right, but why did it take a playback feature for you to realize this?

Google Docs has always had a revision history tab.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#112

Post by scott_karana »

getsaf wrote: post #56
scott_karana wrote: post #46

Earlier quoted context omitted.

I've tried to use a clipboard manager for years to help obviate this sort of issue. I'm currently using ClipMenu on OSX, which hits all the right needs for me. Anyone have a suggestion for Windows?

I'm not sure how this helps the issue but here's a great windows clipboard manager. http://ditto-cp.sourceforge.net/

Well, I found that I would use search/URL fields as a "temporary scratchpad" for passwords, when I had to copy-paste something else, and didn't want to lose the password in my clipboard. The history means I don't have to worry about that anymore.

Thanks for Ditto!

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#113

Post by nitrogen »

morgante wrote: post #111
eplanit wrote: post #107

Earlier quoted context omitted.

I think the issue for some (including myself) is that this revelation shows that the vulnerability of a compromised document is greater than the apparent contents of the document. It includes all keystrokes, which could expose other ideas the writer might have had (but discarded), etc. This fact makes me even less inclined to use Google docs.

Right, but why did it take a playback feature for you to realize this? Google Docs has always had a revision history tab.

The parent comment was clearly aware of the versioning feature, and appears to be more surprised by the keypress-level granularity of the versioning that may not have been apparent in the official UI.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#114

Post by haylem »

divegeek wrote: post #106
haylem wrote: post #104

Earlier quoted context omitted.

Well, you know what, I actually realized that there's no timing info in the recorded data. So, no problem. I jumped the gun quite a bit. Still, a bit worrysome, because it could easily be modified to track it. And for all we know, some sites could be doing that. Facebook was (at least at some point) listening to what you were typing in timeline posts even if you didn't actually decide to send them, so it wouldn't be…

The article says there is timing data, with microsecond resolution. That's how the author's tool is able to provide "real-time" playback.

Hmm, true, it's mentioned in first paragraph, but I couldn't find it in the rest of the article's body when I came back to it. Well, this is rather bad then...

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#115

Post by brazzledazzle »

TheLoneWolfling wrote: post #108
divegeek wrote: post #105

Earlier quoted context omitted.

There's no such warning displayed, because that would be a security hole. This password security measure is a Chrome extension that's required by company policy to be installed on all corporate machines. It watches all input (to browser forms) and if it detects your password being typed anywhere other than an actual sign-on page, then the next time you sign on successfully you're required to change your password. I b…

How would you do that though? Because I can't think of an efficient way to do that that doesn't involve having the extension have access to the password. I mean, you could store the password hash + length, but then you're securely hashing every single overlapping substring of what you enter, which is not exactly fast. Especially as KDFs are designed to be slow. And if you store the password hash then you enable an of…

It wouldn't have to do it in real time right? It could easily batch typing sessions and have the server chew through them asynchronously.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#116

Post by redblacktree »

lostlogin wrote: post #86
hunter2_ wrote: post #79

Earlier quoted context omitted.

Plenty of times I've come back to my computer, typed my OS password expecting that it was locked, waited for my display's turn-on lag, and found that it wasn't locked (grace period). I type the password blind, but reserve the enter until I have visual feedback. At least typical IRC clients don't transmit until hitting enter. Browser omnibars and Javascript can send away every keystroke as it happens. Now I want to se…

A long time ago in a lecture hall far far away a head of school was giving us a pre-exam talk of some kind. It was too all health science students. As he talked he logged into the system. With the projector showing what he was doing he missed the tab key and typed his username and password into the username field. I had a look round the room and no one else seemed to have noticed. On his desktop sat a folder titled "…

Are you going to tell us the rest of the story?

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#117

Post by TheLoneWolfling »

brazzledazzle wrote: post #115
TheLoneWolfling wrote: post #108

Earlier quoted context omitted.

How would you do that though? Because I can't think of an efficient way to do that that doesn't involve having the extension have access to the password. I mean, you could store the password hash + length, but then you're securely hashing every single overlapping substring of what you enter, which is not exactly fast. Especially as KDFs are designed to be slow. And if you store the password hash then you enable an of…

It wouldn't have to do it in real time right? It could easily batch typing sessions and have the server chew through them asynchronously.

So then you're sending every keystroke people make to a central server?

Even assuming that the connection is secure (never a good assumption), that still means that there is a single point of failure. And one with drastic consequences.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#118

Post by brazzledazzle »

TheLoneWolfling wrote: post #117
brazzledazzle wrote: post #115

Earlier quoted context omitted.

It wouldn't have to do it in real time right? It could easily batch typing sessions and have the server chew through them asynchronously.

So then you're sending every keystroke people make to a central server? Even assuming that the connection is secure (never a good assumption), that still means that there is a single point of failure. And one with drastic consequences.

But doesn't any service that you authenticate against assume the channel is secure? Presumably this would use SSL.

I do agree about the single point of attack though. Perhaps you could do an asynchronous substring check locally when the CPU is idle.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#119

Post by TheLoneWolfling »

brazzledazzle wrote: post #118
TheLoneWolfling wrote: post #117

Earlier quoted context omitted.

So then you're sending every keystroke people make to a central server? Even assuming that the connection is secure (never a good assumption), that still means that there is a single point of failure. And one with drastic consequences.

But doesn't any service that you authenticate against assume the channel is secure? Presumably this would use SSL. I do agree about the single point of attack though. Perhaps you could do an asynchronous substring check locally when the CPU is idle.

But then anyone who can gain access to the computer once can then perform an offline attack on the password at their leisure.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#120

Post by mintplant »

haylem wrote: post #103
mintplant wrote: post #70

Didn't Google Docs used to have this "playback" feature built in? I clearly remember there being a slider at the top of the page that you could scrub back and forth through a document's revision history.

I think you've got it confused with some implementations of EtherPad. At least I know I've seen it there, but I don't recall seeing it in Google Docs.

No, I've never used EtherPad before. It's probably Google Wave I'm thinking of.
Post reply on HN