Is there any possibility that a webapp or website I am using could be tracking or recording what I type on the page (into no box) or into input or textboxes without me having submitted a form/clicked a button after doing the typing?
For example, what happens if I accidentally paste a username/password into a text form on a website I am visiting?
This is definitely possible. JavaScript can track any text which is typed in a text field. If you've ever used Google Wave (or former Etherpad) than you know the live typing feature (if you write an character it is almost immediately visible for the user users).
But despite the technical possibility you shouldn't worry about that issue. It is not practical for any website the capture such rare events. It would require a huge manual effort the get the passwords out of the whole garbage which gets sent to the server. As an addition no one knows for which website this password was.
If it was an highly sensitive account (like online banking or the code for firing nuclear weapons or whatever) just change it immediately.
It is possible to do it using JavaScript so in general you have to trust the website.
Lots of websites support keyboard shortcuts. For example enable the keyboard shortcuts in your Gmail (I suppose you are using Gmail, since you have that avatar) and then just press ? to see it in action.
Yes.
If it was an ASP.NET site (for example) the writer could write code that handles the KeyDown or TextChanged events for text boxes and store and send what you type. The same would be true for other languages.
