And something using keystroke injection to abuse the exception?

Ehh. The only structural gap from a local password logger to a universal account takeover is whether you’re receptive to nice men who explain that they’d like you to send them a “log file”. Working on a user’s behalf has to include protecting them from security holes they might not expect.

My favourite one of these has to be Outlook Online blocking nearly all Python, Bash and exe files sent via email...at the Faculty of computer science. Who would ever need to send code to others at the computer faculty? And it's not like it prevents you from sending it, it just prevents the recipient from downloading it, so there's no indication of anything wrong until it might be too late. Oh, and it doesn't even say "hey, that's malware". It just shows a little red X and removes the download button. No tooltip or popup, it just looks like a generic error. Had to go to Reddit to find out it's an antimalware thing.

I mean - Tailscale is a remote access tool...