41–50 of 150 posts
Complete tangent but... why is this a NPM package? There is no actual Javascript code in it.
They should probably have private: true in there though, to stop it getting published by mistake, since it isn't a component anyone could usefully import.
Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…
The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...
This vulnerability was published (another article) over a year ago. I'm surprised Chrome hasn't fixed it. I think this means browsers will never fix this issue. I won't be using auto-fill on untrusted webaites.
As other comments have noted, it isn't trivial to fix completely, so I believe most browsers just haven't bothered at all, but have implemented some extra protection for credit cards (and of course, CVV numbers are never stored in the first place).
Earlier quoted context omitted.
How obvious is this to the user? This seems like a detail that'd be easily overlooked.
It's quite obvious. Just tried it myself [1]. You first select an identity to use to auto-fill. When doing that, it will tell you the data it will insert in the subtitle. You can also click customize and choose what data to place into each field. [1] - http://imgur.com/a/HL59q
The only thing I can think of is a separate prompt, that would ask "Do you want to autofill Name, Address, Phone..." etc.
This is a nice example of a feature that is trivially accessible and yet unobtrusive.
(Alternatively, you can press the down-arrow on the empty field, which will open the auto-completion as well.)
In case anyone is worried, most (all?) browsers do not autofill credit card information without the user explicitly clicking into the credit card field so there's no chance of a hidden field stealing your CC information.
And even when clicking into the credit card field you still need to click a little popup that asks if you want to autofill.... at least that's how it works for me, I don't remember ever changing a setting on Chrome for this so I assume this is the default state. In fact it does something similar for my address information too. There must be some setting because I know my address autofill info is saved in Chrome but w…
LastPass prompts every time before autofilling your CC# into a form, so it might avoid this issue in that case. I do believe it would still fail exposing your basic info, such as in this example, however.
Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…
FYI this doesn't work for credit card info, at least not in Chrome. That information has to be auto-filled separately.