Swift-Keylogger – Keylogger for MacOS written in Swift using HID
github.com
github.com
QA reported that on the login screen, you sometimes had to press tab twice to get the overlay to open. Just on that one screen.
I had a piece of code that was looking for the tab keydown event to open the overlay, but in some cases the event was not being triggered. Turned out that the browser password field used EnableSecureEventInput and so the if the cursor focus was in the password input box, the tab button press would not be detected by my code. Pressing it twice worked because:
-first tab press moved cursor focus out of the password box
-second tab press was in the username input field which was not a secure input field, so my code received the tab keydown event.
The weird part about this is since the tab keydown moves the cursor focus out of the secure text box what you receive is a tab keyup event with no keydown before it.
/S?he|\w+kin|.*/
On a serious note, I was looking for that word, but failed to remember it[0].
You could listen for the keydown, but you wouldn't hear it, so you may as well ignore what you can't hear.
- I did not click through to their profile.
The cause for both of these is that my mobile HN experience is horrible for me (a lazy person).
I spent a few seconds looking for a word to replace "She/He", when none came to mind I fell back to a regular expression[1]. As iaml pointed out[2] (along with others) https://en.wikipedia.org/wiki/Singular_they is the proper solution to this issue, and I will try to remember that in the future.
---
[1] as we so often do in our daily lives.
[2] https://news.ycombinator.com/item?id=15489652
---
In my second attempt at comedy today, Trying to perform the error-prone art of interpreting genders based on usernames, the best I came up with for you is
/^\0_$/
I'll explain the joke, so that no-one feels left out: I interpret name "Void" as gender "null", then carry the underscore over, using artistic license, to make the regex more interesting.
It's a large reason why "web applications" became a thing -- it gives you sandboxed remote programs (and easy-access to boot!) Even if the web-browsing sandbox is flawed, it's been a convenient band-aid over a fundamental OS feature that, sadly, still doesn't properly exist.
New apps in the Mac App Store have to run in the sandbox and they are quite severely limited.
I can't create a great way to batch install/update/migrate my phone because everything requires manual approval.
I can't use my own browser or sms app on ios cause it's not allowed by the permissions system.
I can't install a new driver on my phone.
Remember the bs update apple did that broke the home button, forcing people to buy a new phone ? I can't prevent that either.
I'm actually for permissions and sandboxes for most apps. But i want a manual override when i need one.
I don't know of any.
I think both of these features require explicit manual permissions (i.e. having to go to the system settings and whitelist the app) to be enabled. Also Android permission dialogs refuse to pop up if there is an untrusted screen overlay (which meant that my experience with Lux when with other apps' permission dialogs involved either manually disabling the virtual screen brightness adjustment or having it automatically disabled temporarily, which resulted in unpleasant surprises while using the phone at night).
I'm not against sandboxing, but if there should be a way to say i know what i'm installing, go with it. Otherwise you will say good bie to new ways of debugging, alternative drivers, unusual way of routing network packets, innovative UI interactions that are not part of the standards widgets, or anything you haven't think of yet.
The computing experience you have today is the result of all the stuff we fiddle with for the last 30 years because it was allowed to. It would be foolish thz big players invented most of it.
If you want an example, there's F.lux, which doesn't work (without rooting) on Android and iOS.
Run a database ? (good luck running postgres with the OS killing processes all the time)
Run docker ?
Taking screen captures anywhere ? (this one actually got me yesterday while trying to screen capture netflix on my one plus 3)
Run f.lux ?
Run one virtual machine with windows on it ?
Capture 3G traffic with wireshark ?
Install a driver to read a USB key in another partition format not allowed by the OS ?
Bypass DRM ?
Resize partitions to get a dual boot ?
Run Wine ? (and they tried hard. Since fosdem 2014 at least)
Install patches as soon as a vulnerability is discovered, and not waiting on your phone seller to wake up ?
And if you just consider iOS, it's way, way worse. At least on android you have access to part of the filesystem.
The thing is, in computing, nothing works exactly right. And with my laptop, I have always a way to work around problems. With phones, I'm just stuck with it. Multitasking sucks. Automation is terrible. You may install a GNU env, but it has access to so little you can't script your way out of anything.
Reading up on it further [0] it seems you could write an anti-keylogger. Just have an app that calls EnableSecureEventInput and never disables it and no other processes would be able to capture key input:
"The system will no longer pass keyboard intercept processes keyboard events if your process has enabled secure input even when your process is moved to the background. It now becomes your process' responsibility to call DisableSecureEventInput when secure entry input is not required, such as when your process detects that it is moving to the background."
0: https://developer.apple.com/library/content/technotes/tn2150...
A good way to check whether EnableSecureEventInput is enabled is to start the Keyboard Viewer that comes with MacOS and see if it echoes keystrokes.
License
MIT
Free Software, Hell Yeah!
// Created by Skrew Everything on 14/01/17.
// Copyright © 2017 Skrew Everything. All rights reserved.
At least I learned something. My apologies.
Probably the author just forgot to edit them to their liking.