Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I reverse-engineered Google Docs to play back any document's keystrokes

features.jsomers.net

Post reply on HN
Print view View original

101–110 of 121 posts

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#101

Post by haylem »

Fine, there's the worry you typed in something sensitive in the document. But it's far from being the major worry here, if I understood everything correctly...

Basically, if you have all keystrokes with timing info, you've got all the keystroke dynamics required to establish an individual's biometric keystroke fingerprint. And that seems freaking scary to me, for a few reasons.

1) Impersonation

Anyone can grab that fingerprint from any shared file on Google Docs and then feed it to a program so that you can impersonate the author for various purposes... Be it typing a blog comment (harmless), or something more insidious like logging into a secure system using that type of auth system.

Another trivial example could be impersonating someone on a Coursera course, where they use such fingerprints for identification on paid / "signature track" courses, which allow you to get a verified certificate from a known university. They use a photo, but that can also be fed by a tweaked webcam driver. So there you have it, you can hire someone to take lessons and pass exams for you. Or fail you.

2) Anonymity

Anyone with access to a shared google doc can now get your fingerprint, and if they implement a similar record on another website, they can identify who you are. Maybe such fingerprints are not 100% unique, but they surely can be accurate enough to pick you from a crowd of anonymous commenters on a website, for instance.

You could also imagine that a software you already have installed could identify you using a similar approach.

In that case, surfing using a Tails/Tor VM and in the incognito mode of your browser won't help you that much.

I'm sure in a perfect world this could sound awesome: no logins required anywhere, just type in stuff and get automatically ID-ed and credited for what you type and say. In our world, that could be bad for some people.

Plus I can only imagine how bad that would be if companies started to include in their web and desktop apps EULA that you agree to share keystroke dynamics with them and that you auhtorize them to redistribute it to partners. BAM, a global commercial database of uniquely identified users, no matter what account or throwaway email they use. Forget cookies and stuff, that won't need that anymore.

Bit far-fetched of course, as that would require some effort. But it's not that much effort that it wouldn't be interesting enough for someone to do it...

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#102

Post by unfamiliar »

lambda wrote: post #87
r00fus wrote: post #35

Earlier quoted context omitted.

I wonder how much sensitive information is inadvertently pasted into a browser location bar or autofill text box that's silently captured by web apps like Google Docs? I know I've accidentally done the "paste password" into those places accidentally at times.

I believe (can't recall the source at the moment) that on Google computers, they actually watch all of your input for password input, and if you enter your password somewhere other than the official Google single-sign on interface, will make you rotate your password. They're pretty serious about not letting you type your password anywhere other than where you're supposed to.

That sounds like a pretty big security hole. Just "type" random letters until you get a warning saying not to enter your password outside of password fields.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#103

Post by haylem »

mintplant wrote: post #70

Didn't Google Docs used to have this "playback" feature built in? I clearly remember there being a slider at the top of the page that you could scrub back and forth through a document's revision history.

I think you've got it confused with some implementations of EtherPad. At least I know I've seen it there, but I don't recall seeing it in Google Docs.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#104

Post by haylem »

haylem wrote: post #101

Fine, there's the worry you typed in something sensitive in the document. But it's far from being the major worry here, if I understood everything correctly... Basically, if you have all keystrokes with timing info, you've got all the keystroke dynamics required to establish an individual's biometric keystroke fingerprint. And that seems freaking scary to me, for a few reasons. 1) Impersonation Anyone can grab that f…

Well, you know what, I actually realized that there's no timing info in the recorded data. So, no problem. I jumped the gun quite a bit.

Still, a bit worrysome, because it could easily be modified to track it. And for all we know, some sites could be doing that. Facebook was (at least at some point) listening to what you were typing in timeline posts even if you didn't actually decide to send them, so it wouldn't be surprising if some sites did that sort of stuff.

Interesting project idea...

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#105

Post by divegeek »

unfamiliar wrote: post #102
lambda wrote: post #87

Earlier quoted context omitted.

I believe (can't recall the source at the moment) that on Google computers, they actually watch all of your input for password input, and if you enter your password somewhere other than the official Google single-sign on interface, will make you rotate your password. They're pretty serious about not letting you type your password anywhere other than where you're supposed to.

That sounds like a pretty big security hole. Just "type" random letters until you get a warning saying not to enter your password outside of password fields.

There's no such warning displayed, because that would be a security hole.

This password security measure is a Chrome extension that's required by company policy to be installed on all corporate machines. It watches all input (to browser forms) and if it detects your password being typed anywhere other than an actual sign-on page, then the next time you sign on successfully you're required to change your password. I believe there's also an e-mail notification, but it's delayed.

This is actually a pretty good password security technique, specifically because people often inadvertently type their password into the wrong forms due to focus errors, lack of caffeine, etc.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#106

Post by divegeek »

haylem wrote: post #104
haylem wrote: post #101

Fine, there's the worry you typed in something sensitive in the document. But it's far from being the major worry here, if I understood everything correctly... Basically, if you have all keystrokes with timing info, you've got all the keystroke dynamics required to establish an individual's biometric keystroke fingerprint. And that seems freaking scary to me, for a few reasons. 1) Impersonation Anyone can grab that f…

Well, you know what, I actually realized that there's no timing info in the recorded data. So, no problem. I jumped the gun quite a bit. Still, a bit worrysome, because it could easily be modified to track it. And for all we know, some sites could be doing that. Facebook was (at least at some point) listening to what you were typing in timeline posts even if you didn't actually decide to send them, so it wouldn't be…

The article says there is timing data, with microsecond resolution. That's how the author's tool is able to provide "real-time" playback.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#107

Post by eplanit »

morgante wrote: post #85

I don't understand why most of the commenters here are focusing on the privacy implications rather than the technical aspects. Is this really a privacy breach? It's been obvious that Google stores revision history since it launched—you've always been able to access a thorough revision history in the UI itself...

I think the issue for some (including myself) is that this revelation shows that the vulnerability of a compromised document is greater than the apparent contents of the document. It includes all keystrokes, which could expose other ideas the writer might have had (but discarded), etc. This fact makes me even less inclined to use Google docs.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#108

Post by TheLoneWolfling »

divegeek wrote: post #105
unfamiliar wrote: post #102

Earlier quoted context omitted.

That sounds like a pretty big security hole. Just "type" random letters until you get a warning saying not to enter your password outside of password fields.

There's no such warning displayed, because that would be a security hole. This password security measure is a Chrome extension that's required by company policy to be installed on all corporate machines. It watches all input (to browser forms) and if it detects your password being typed anywhere other than an actual sign-on page, then the next time you sign on successfully you're required to change your password. I b…

How would you do that though?

Because I can't think of an efficient way to do that that doesn't involve having the extension have access to the password.

I mean, you could store the password hash + length, but then you're securely hashing every single overlapping substring of what you enter, which is not exactly fast. Especially as KDFs are designed to be slow.

And if you store the password hash then you enable an offline attack.

Re: How I reverse-engineered Google Docs to play back any document's keystrokes

#109

Post by TheLoneWolfling »

cheepin wrote: post #91
forca wrote: post #55

Earlier quoted context omitted.

Yes. I hate receiving documents in .docx or any other proprietary format, especially if I have not agreed to that format prior to receiving them. I like plain text if at all possible. I'll happily receive PDFs because I can view them under Linux/BSD, but others piss me off. People THINK MS Word is the de facto business standard. It isn't. Text and PDF are the standards. Never had issues with either. I had a friend te…

>locked down to prevent recruiters and others from changing it to something other than the original Can you elaborate? Why would they want to change your CV?

Either to make it better (recruitment agencies, etc), or to make it worse (we want to hire but we have to hire the best-qualified person)
Post reply on HN