Browser auto-fill phishing
github.com
Browser auto-fill phishing
1–10 of 150 posts
Re: Browser auto-fill phishing
#2Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has been filled in would be a nice touch. Maybe a browser extension could accomplish this?
Re: Browser auto-fill phishing
#3Even as an experienced user it never crossed my mind that this might happen. Good catch
Re: Browser auto-fill phishing
#4This vulnerability was published (another article) over a year ago. I'm surprised Chrome hasn't fixed it.
I think this means browsers will never fix this issue. I won't be using auto-fill on untrusted webaites.
Re: Browser auto-fill phishing
#5I found this https://bugs.chromium.org/p/chromium/issues/detail?id=132135 which was created when someone noticed the issue happening to their honeypot input box. Looks like it was closed a while ago.
I saw this example doing the rounds on twitter. Hopefully the chrome devs notice the noise and move up the priority on fixing / addressing it.
Re: Browser auto-fill phishing
#6Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…
Only allowing non-(display:none) fields wouldn't be enough. You could still position them off screen, or behind an image, or very small or nearly transparent, or any other sneaky tactic.
Your second idea about an auto-fill warning would be better. Maybe a simple footer warning or something.
Re: Browser auto-fill phishing
#7Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…
The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport?
Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...
Re: Browser auto-fill phishing
#8In case anyone is worried, most (all?) browsers do not autofill credit card information without the user explicitly clicking into the credit card field so there's no chance of a hidden field stealing your CC information.
Re: Browser auto-fill phishing
#9I really with that browsers didn't autocomplete ever. I've had instances where they will happily auto-complete my entire credit card number. Usually, they'll only memorize the first 4 digits, but sometimes they memorize the entire thing.
Re: Browser auto-fill phishing
#10Firefox doesn't exhibit this behavior, but the site doesn't specifically state which browsers this affects.