Server and input activities are relayed to a client as messages called events. These events include keystrokes, pointer movements, color changes, etc. When each window of a client is created, a list of the events it is interested in receiving is sent to the server. When some input or server activity occurs, the server checks which windows should be notified. Although a client normally only asks to be notified for events in its own windows and subwindows, a client can request to be notified about all events for any window. As a result, a client can ``eavesdrop'' on the activities of any other client on a given display. In particular, this means that a client can intercept keystrokes associated with logins made from another window on a given display. Such keystrokes include a login password.