Your voice typing app will type your password into a login box. Here is how to stop it

Description and use

VoxScribe now blocks voice‑typed passwords by checking if the focused field is a password field before typing or recording.

Problem

A dictation app may inadvertently type spoken passwords into password fields, exposing them in history and on disk.

Outcome

Passwords are no longer typed or logged by VoxScribe, while the app remains responsive and lightweight.

Workflow

• 1. Capture speech and convert to text.
• 2. Before typing, query the focused window for password status using Win32 style check.
• 3. If the Win32 check fails (e.g., in browsers), perform a UI Automation query for the IsPassword property.
• 4. Handle Chromium’s lazy accessibility tree by retrying after 150 ms if the first result is a bare pane.
• 5. If a password field is detected, abort typing and skip recording the text.
• 6. If no password field, type the text and record the transcript.
• 7. Ensure all checks run on a dedicated thread with a 0.5 s timeout and a busy flag to avoid blocking the hotkey.

Evidence

A dictation app has a simple job: you hold a key, say a sentence, and the text is typed into whatever window has focus.

Source

If it reports a password field, the text is not typed, and it is not written to the transcript or the history either.

Source

The bug that looked like a failed check… Chromium builds its accessibility tree lazily… The fix is small: if the first answer is not a password but the element is a bare pane, wait 150 ms and ask once more.

Source