Hacker News Reader

Comment by cabaalis | Hacker News Reader

I felt like you did, and watched the video and he is certainly looking at an HTTPS data stream.

I think the argument though is that the request is being logged and that some employee is reviewing logs and grabbing data.

If that is the case, then it seems there is a known pool of suspects to charge with theft...

View on HN

Yeah, and the amount of data to sift through there would be truly enormous.

I'd wager there was just some malware on the machine.

Apparently it's a list of 12 words from 2048. I guess you could potentially try and pattern match that, but that'd be a ton of a sifting.

The amount of data to sift through? What website am I on right now? Just grep for 64 character strings.

The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.

The stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.)

I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed.

Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.

Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.

Access to this data is very tightly controlled, it's likely a single digit number of people.

Reply on news.ycombinator.com