Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser auto-fill phishing

github.com

Post reply on HN
Print view View original

21–30 of 150 posts

Re: Browser auto-fill phishing

#21

Post by jonknee »

athenot wrote: post #7
aesthetics1 wrote: post #2

Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

> So the browser would have to determine if the item is visible to the user, which is not trivial

This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

Re: Browser auto-fill phishing

#22

Post by kardos »

robertelder wrote: post #9

I really with that browsers didn't autocomplete ever. I've had instances where they will happily auto-complete my entire credit card number. Usually, they'll only memorize the first 4 digits, but sometimes they memorize the entire thing.

You can disable it,

https://support.mozilla.org/en-US/kb/control-whether-firefox...

https://support.google.com/chrome/answer/142893?co=GENIE.Pla...

Re: Browser auto-fill phishing

#24

Post by IMcD23 »

lojack wrote: post #17
eridius wrote: post #13

Earlier quoted context omitted.

In Safari, the autofill dropdown explicitly said it would fill "email, work, address" (and I guess it implies that name is included).

How obvious is this to the user? This seems like a detail that'd be easily overlooked.

It's quite obvious. Just tried it myself [1].

You first select an identity to use to auto-fill. When doing that, it will tell you the data it will insert in the subtitle.

You can also click customize and choose what data to place into each field.

[1] - http://imgur.com/a/HL59q

Re: Browser auto-fill phishing

#25

Post by ericrav »

I'd rather have only the field I selected autofilled and be given a secondary option to have every field (or maybe choose which fields) in a form autofilled. This bothers me in innocent, non-phishing forms too—especially when the designers don't put labels on the fields and only use placeholders, which I can no longer see after autofill.

Re: Browser auto-fill phishing

#26

Post by avh02 »

kardos wrote: post #22
robertelder wrote: post #9

I really with that browsers didn't autocomplete ever. I've had instances where they will happily auto-complete my entire credit card number. Usually, they'll only memorize the first 4 digits, but sometimes they memorize the entire thing.

You can disable it, https://support.mozilla.org/en-US/kb/control-whether-firefox... https://support.google.com/chrome/answer/142893?co=GENIE.Pla...

autofill actually annoys me, which is why it's one of the first things i disable when setting up my browser(s)

Re: Browser auto-fill phishing

#27

Post by tcoff91 »

SippinLean wrote: post #18

LastPass prompts every time before autofilling your CC# into a form, so it might avoid this issue in that case. I do believe it would still fail exposing your basic info, such as in this example, however.

LastPass has previously had autofill exploits (not with regards to CC though). I would highly recommend disabling auto-fill.

Re: Browser auto-fill phishing

#28

Post by pc86 »

jonknee wrote: post #21
athenot wrote: post #7

Earlier quoted context omitted.

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

> So the browser would have to determine if the item is visible to the user, which is not trivial This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

> Should autofill skip regular form elements that are just a little below the viewport?

Re: Browser auto-fill phishing

#29

Post by flanbiscuit »

error54 wrote: post #8

In case anyone is worried, most (all?) browsers do not autofill credit card information without the user explicitly clicking into the credit card field so there's no chance of a hidden field stealing your CC information.

And even when clicking into the credit card field you still need to click a little popup that asks if you want to autofill.... at least that's how it works for me, I don't remember ever changing a setting on Chrome for this so I assume this is the default state. In fact it does something similar for my address information too. There must be some setting because I know my address autofill info is saved in Chrome but when I tried the demo I did not see my address info in the headers

Re: Browser auto-fill phishing

#30

Post by Terr_ »

daheza wrote: post #5

I found this https://bugs.chromium.org/p/chromium/issues/detail?id=132135 which was created when someone noticed the issue happening to their honeypot input box. Looks like it was closed a while ago. I saw this example doing the rounds on twitter. Hopefully the chrome devs notice the noise and move up the priority on fixing / addressing it.

> Chrome Autofill is specifically designed to help users quickly fill forms that they've never filled before.

Browsers auto-guessing private data into arbitrary fields on never-before-used webpages?

IMO that's "Just because you can doesn't mean you should" territory.

Post reply on HN