(Originally from here), this is a more detailed answer regarding pasting a password into the...
In this scenario, the name resolution is your worst enemy, as it leaks the password in multiple ways. Your password will leak to multiple DNS servers and through the local network – mostly in plain text, even if you are using encrypted connection to your DNS resolver.
- DNS resolvers will not handle the query just within themselves: they will start asking it from the authoritative name servers, starting from the root servers, or from a forwarder that does it for them.
- As this is not a real working domain name, it will be also queried using
- Multicast DNS (mDNS, RFC 6762) and
- Link-Local Multicast Name Resolution (LLMNR, RFC 4795).
- Both mDNS and LLMNR are using IP multicasting.
- By default, ethernet switches will flood these requests to every port, as they won't see the multicast MAC addresses beginning with
01:00:5e as a source address on any ethernet frame.
- Some switches can limit this using IGMP snooping, but it's still possible for anyone to join these multicast groups to get these IP multicast transmissions.
In addition, the password will leak to your search provider with most modern browsers after the name resolutions fails. Some browsers may also start sending out contents in the address bar even before you have pressed the enter, as explained in an answer for "Does accidentally pasting password into browser URL field send it over the network?".
TL;DR: Change your password.
In this example,
testp4ssw0rd is typed into the address bar of Google Chrome on Windows 10.
192.0.2.100 has local domain (configured through DHCP)
example.com and, as a common bad practice,
192.0.2.254 is a router that also acts as a DNS resolver.
example.com, the resolver, any MITM and the
ns1.example.com will know the
example.local, the the NXDOMAIN reply comes from a root server.
The MDNS (
220.127.116.11 is an IP multicast query message with MAC address
01:00:5E:00:00:FB. It asks the host having that name to identify itself.
- Likewise, LLMNR (
244.0.0.252 is an IP multicast query message with MAC address
- As there wasn't devices with these names, you won't see mDNS/LLMNR responses.