Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser auto-fill phishing

github.com

Post reply on HN
Print view View original

61–70 of 150 posts

Re: Browser auto-fill phishing

#61

Post by nine_k »

This is why I never put anything secret into browser autofill data. No credit cards, no passwords, nothing I would not be OK with disclosing publicly, or already did.

Sensitive info belongs to a password manager which limits it to the domains the data belong.

Credit card numbers are a pain, though. I could put them to a password manager, and manually select to fill only that particular field when I need to. In reality I rarely buy things where PayPal or Amazon payment options are not available; I suppose Stripe offers a similar service.

Re: Browser auto-fill phishing

#62

Post by misterballs »

Fillr autofill app requires users to approve every piece of data before autofilling a form. Makes it easy to know when a site is trying something shifty. Dashlane also lets you pick exactly what to fill. Native browser autofills have been battling phishing exploits since early IE days.

Re: Browser auto-fill phishing

#63

Post by gohrt »

nine_k wrote: post #61

This is why I never put anything secret into browser autofill data. No credit cards, no passwords , nothing I would not be OK with disclosing publicly, or already did. Sensitive info belongs to a password manager which limits it to the domains the data belong. Credit card numbers are a pain, though. I could put them to a password manager, and manually select to fill only that particular field when I need to. In reali…

Browsers don't auto-fill credit cards and passwords, today, because they are private.

Chrome (and I assume others) has a secure credit card and password auto-fill, separate from regular form auto-fill.

Re: Browser auto-fill phishing

#64

Post by gohrt »

lightbyte wrote: post #47
flanbiscuit wrote: post #29

Earlier quoted context omitted.

And even when clicking into the credit card field you still need to click a little popup that asks if you want to autofill.... at least that's how it works for me, I don't remember ever changing a setting on Chrome for this so I assume this is the default state. In fact it does something similar for my address information too. There must be some setting because I know my address autofill info is saved in Chrome but w…

Last time I autofilled a CC with chrome it asked me to input the cvv number on the card before it filled in.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

Re: Browser auto-fill phishing

#65

Post by theGimp »

athenot wrote: post #7
aesthetics1 wrote: post #2

Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

My thinking is the user should explicitly autofill each field. Yes, it involves more work, but it's really not much work to click on a field and pick the right autofill value.

I'm always concerned about using autofill because browsers eagerly fill any field they have data for.

Re: Browser auto-fill phishing

#67

Post by takeda »

vog wrote: post #46
matt_wulfeck wrote: post #33

The only thing I can think of is a separate prompt, that would ask "Do you want to autofill Name, Address, Phone..." etc.

That popup is not needed. Firefox does this simply through auto-complete. The user starts typing their email address, and voila, the browser completes it. This is a nice example of a feature that is trivially accessible and yet unobtrusive. (Alternatively, you can press the down-arrow on the empty field, which will open the auto-completion as well.)

Old Opera went one step further, where it would fill forms using a Wand button. This approach also was used for logging in.

IMO, much better way, since it works well in situation where your passwords are encrypted and browser is configured to forget master key after a while.

Firefox in that scenario will bug you about master password each time you go to page where such password is stored.

Re: Browser auto-fill phishing

#68

Post by Rumudiez »

theGimp wrote: post #65
athenot wrote: post #7

Earlier quoted context omitted.

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

My thinking is the user should explicitly autofill each field. Yes, it involves more work, but it's really not much work to click on a field and pick the right autofill value. I'm always concerned about using autofill because browsers eagerly fill any field they have data for.

This is how Firefox's autofill worked for me just now. Glad to see some more justification for getting off the Google train!

Re: Browser auto-fill phishing

#69

Post by nucleardog »

nine_k wrote: post #61

This is why I never put anything secret into browser autofill data. No credit cards, no passwords , nothing I would not be OK with disclosing publicly, or already did. Sensitive info belongs to a password manager which limits it to the domains the data belong. Credit card numbers are a pain, though. I could put them to a password manager, and manually select to fill only that particular field when I need to. In reali…

> Sensitive info belongs to a password manager which limits it to the domains the data belong.

So all that stands between you and being in this exact situation (or worse, since passwords) is your password manager's url comparison?

I refuse to use LastPass - the interface is horrible (probably because you're expected to use the browser extension). But I don't want my password manager anywhere near my browser. I'd really rather have to take an affirmative action in order to release each individual piece of information so I know what I'm disclosing and to who.

Re: Browser auto-fill phishing

#70

Post by bradjohnson »

gohrt wrote: post #64
lightbyte wrote: post #47

Earlier quoted context omitted.

Last time I autofilled a CC with chrome it asked me to input the cvv number on the card before it filled in.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

I don't know about this feature, but why couldn't it be stored as a hash?
Post reply on HN