@xor well, actually.. if the attackers inject javascript that sends keystrokes, as happened to Slack early on.. but Slack kept very quiet about it. This super sucked btw https://t.co/n9JEKyKb4i