Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser auto-fill phishing

github.com

Post reply on HN
Print view View original

71–80 of 150 posts

Re: Browser auto-fill phishing

#71

Post by chinathrow »

choward wrote: post #38
jonknee wrote: post #21

Earlier quoted context omitted.

> So the browser would have to determine if the item is visible to the user, which is not trivial This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

> If an element isn't drawn it shouldn't be autofilled. So if a form is too long and you need to scroll, all those fields you can't see won't be auto-filled? Sounds pretty terrible IMO.

To me (as a non autofill user), the published bug sounds way more harmful than a little inconvenience.

Re: Browser auto-fill phishing

#72

Post by cbr »

nucleardog wrote: post #69
nine_k wrote: post #61

This is why I never put anything secret into browser autofill data. No credit cards, no passwords , nothing I would not be OK with disclosing publicly, or already did. Sensitive info belongs to a password manager which limits it to the domains the data belong. Credit card numbers are a pain, though. I could put them to a password manager, and manually select to fill only that particular field when I need to. In reali…

> Sensitive info belongs to a password manager which limits it to the domains the data belong. So all that stands between you and being in this exact situation (or worse, since passwords) is your password manager's url comparison? I refuse to use LastPass - the interface is horrible (probably because you're expected to use the browser extension). But I don't want my password manager anywhere near my browser. I'd real…

    your password manager's url comparison?
Better than manual url comparision! A surprising number of humans think things like www.goodcompany.evil.com are urls for "Good Company", and anyone can screw up and make mistakes checking urls (www.goodcomany.com).

Re: Browser auto-fill phishing

#73

Post by nine_k »

nucleardog wrote: post #69
nine_k wrote: post #61

This is why I never put anything secret into browser autofill data. No credit cards, no passwords , nothing I would not be OK with disclosing publicly, or already did. Sensitive info belongs to a password manager which limits it to the domains the data belong. Credit card numbers are a pain, though. I could put them to a password manager, and manually select to fill only that particular field when I need to. In reali…

> Sensitive info belongs to a password manager which limits it to the domains the data belong. So all that stands between you and being in this exact situation (or worse, since passwords) is your password manager's url comparison? I refuse to use LastPass - the interface is horrible (probably because you're expected to use the browser extension). But I don't want my password manager anywhere near my browser. I'd real…

Well, yes. A domain name, when backed by an SSL certificate, gives a modicum of certainty that information is not being siphoned to a third party.

A password manager running outside my browser and only communicating the bare minimum required by a page, after checking its certificate, sound like a good idea. LastPass is almost there; the only reservation is that it's not run on a machine controlled by you. Other similar solutions overcome this limitation.

A browser extension is actually a great approach, too: it can and should be open-source and signed, thus reasonably tamper-proof. It should, again, do the bare minimum regarding the communication with the actual password store. Its usefulness is mostly in discovering the mapping between form controls and info to be stored.

Re: Browser auto-fill phishing

#74

Post by tcfunk »

I actually ran across this a while ago, but didn't think to call it phishing.

I was trying to create a honeypot for a front-facing web form, but because of the name I gave the honeypot field, some people's autofill information was filling out that field without them knowing.

Re: Browser auto-fill phishing

#75

Post by hamhamed »

gohrt wrote: post #64
lightbyte wrote: post #47

Earlier quoted context omitted.

Last time I autofilled a CC with chrome it asked me to input the cvv number on the card before it filled in.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

Chrome doesn't store the CVV, Google does. It syncs with your Google wallet account, and if the CVV is matched, then the credit card is auto filled

Re: Browser auto-fill phishing

#77

Post by vxNsr »

Raphmedia wrote: post #36
jonknee wrote: post #21

Earlier quoted context omitted.

> So the browser would have to determine if the item is visible to the user, which is not trivial This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

Well, then simply make them height:0px or put a with a white background over it. Change the input and make it text-color: white; background-color: white; Change it's z-index to be lower than your other elements, etc.

This makes the case that auto fill just ain't that secure, I guess if we use it we just need to accept that.

Re: Browser auto-fill phishing

#78

Post by grandalf »

hamhamed wrote: post #76
grandalf wrote: post #66

This is a very clever hack. I've tried in the past to adjust my HTML to disable autofill and it's not possible to prevent Chrome from aggressively doing it.

It's disabled if you do autocomplete=off in the attributes

Not in my tests, it continued to aggressively populate forms with autocomplete="off" set.

Re: Browser auto-fill phishing

#80

Post by danielweber »

gohrt wrote: post #64
lightbyte wrote: post #47

Earlier quoted context omitted.

Last time I autofilled a CC with chrome it asked me to input the cvv number on the card before it filled in.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

Chrome isn't a credit card vendor. I can save your credit card number for you too, if you want.
Post reply on HN