Hacker News Reader

If you are able to grab the users password off of their computer then you are able to capture it as they type it. Passwords are stored unencrypted on computers all the time, your browser stores passwords.

View on HN

The point of tokenizing is to minimize the number of times you ever need to handle the actual password, in part to avoid exactly those attacks.

Reading keystrokes sent to other applications requires higher privileges than reading registry and filesystem, no?

Not on linux/x.org (wayland is more secure)for certain... i am guessing not on windows either but i am not sure...

Reply on news.ycombinator.com