TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Sketch user credentials leaked in logs

4 pointsby ksajadi4 days ago

1 comment

mstade3 days ago
&gt; From v96 of Sketch onwards, a bug in the Mac App caused that list of actions to include text users entered into text fields, including secure text fields. This meant that, in the case that Sketch crashed soon after you had entered your Sketch account email or password (or both), this information could be sent as part of the crash report.<p>These guys have a tendency to bury the lede. Sketch worked as a keylogger and information was transmitted (and presumable stored) in clear text, that&#x27;s the beginning and end of it. Not only would this affect logons to Sketch, it would presumably affect all information entered into designs as well. If you design a screen that includes sensitive information, Sketch would have this as well.<p>I reached out to their team about this event and got a mostly canned reply with links to their DPA and privacy policy, wherein of course there is no detail of Sketch acting as a keylogger.<p>I had a Sketch account until this disclosure, and immediately cancelled my subscription and removed my account after this, and will recommend similar action to anyone willing to listen.<p>It was bad enough that Sketch stopped being a local-first application a few years ago, as that was one of the things they had going for them as Figma started eating their lunch, but this is the straw that broke at least this camel&#x27;s back.