Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser auto-fill phishing

github.com

Post reply on HN
Print view View original

91–100 of 150 posts

Re: Browser auto-fill phishing

#91

Post by ksenzee »

cbr wrote: post #72
nucleardog wrote: post #69

Earlier quoted context omitted.

> Sensitive info belongs to a password manager which limits it to the domains the data belong. So all that stands between you and being in this exact situation (or worse, since passwords) is your password manager's url comparison? I refuse to use LastPass - the interface is horrible (probably because you're expected to use the browser extension). But I don't want my password manager anywhere near my browser. I'd real…

your password manager's url comparison? Better than manual url comparision! A surprising number of humans think things like www.goodcompany.evil.com are urls for "Good Company", and anyone can screw up and make mistakes checking urls (www.goodcomany.com).

Add Unicode and it gets worse. I don't trust my eyes to differentiate between Cyrillic а and Latin a. https://en.wikipedia.org/wiki/IDN_homograph_attack

Re: Browser auto-fill phishing

#92

Post by minxomat »

hamhamed wrote: post #75
gohrt wrote: post #64

Earlier quoted context omitted.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

Chrome doesn't store the CVV, Google does. It syncs with your Google wallet account, and if the CVV is matched, then the credit card is auto filled

This is what happens to me:

1) Google Chrome doesn't always explicitly ask for a CCV. If it does, the browser dialog opens.

2) It actually charges $1 per CCV check to verify the credit card.

3) If the CCV check is successful, it does the autofill on the form. However, you still have to enter the CCV in the form manually most of the time.

4) The $1 charge is immediately canceled and thus doesn't affect your account balance.

For reference, here's a screenshot of how my bank receives such a charge: http://imgur.com/qwdM9Jx.png

To be clear, this is not from any Google purchase. That's what happens if I use my CC in Chrome on any site.

It also has to be noted that this implementation is pretty bad. On pre-paid CC (i.e. your CC payments are directly tied to your bank account - there is no CC bill), this will negatively impact your spending balance:

Account balance: All your money.

Spending balance: (account balance) - (pending charges)

Some banks refuse to apply the charge cancellation sent by Google and keep the pending charge active for some fixed amount of time (e.g. 90 days).

Re: Browser auto-fill phishing

#93

Post by minxomat »

gohrt wrote: post #64
lightbyte wrote: post #47

Earlier quoted context omitted.

Last time I autofilled a CC with chrome it asked me to input the cvv number on the card before it filled in.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

The CCV check Chrome does doesn't compare the entered CCV against anything stored at all. Instead, it charges a small amount to verify the credit card. See my comment below.

Your mileage my vary, but I'd be very surprised if it does.

Re: Browser auto-fill phishing

#95

Post by MiddleEndian »

takeda wrote: post #56
aesthetics1 wrote: post #2

Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…

I liked the old Opera approach to this. By default it did not fill the fields, unless you clicked on a Wand button, or used Ctrl+Enter shortcut. This also worked really well with encrypted password storage (if you configured that key was forgotten after e.g. 10 minutes), it did not nag you to enter the password if you visited site where you stored password but did not intended to log in at given time. There's an add-…

I miss the magic wand so much. It also ignored autocomplete=false. Truly a tool that belonged to the user above all else.

Re: Browser auto-fill phishing

#98

Post by Scirra_Tom »

bradjohnson wrote: post #70
gohrt wrote: post #64

Earlier quoted context omitted.

Interesting use of CVV, since vendors aren't permitted to store it. But Chrome does, for you... is that synced across browsers? That would require Google to store the CVV on its servers...

I don't know about this feature, but why couldn't it be stored as a hash?

I might be an order of magnitude off here, but I believe there's only around 1 billion unique numbers per card once you take away check sum digits and look at how they are issued.

Assuming that's correct, it really wouldn't take up much memory or computing power to create a lookup table for every credit card number with hash x.

Re: Browser auto-fill phishing

#99

Post by tomcorrigan »

error54 wrote: post #8

In case anyone is worried, most (all?) browsers do not autofill credit card information without the user explicitly clicking into the credit card field so there's no chance of a hidden field stealing your CC information.

Why would I even care about credit card information being stolen. My bank will reimburse that no questions asked. I am much more concerned about my personal information being leaked. CC fraud costs other people money, identity fraud is much more damaging to me.

Re: Browser auto-fill phishing

#100

Post by ehsankia »

jaxomlotus wrote: post #42
athenot wrote: post #7

Earlier quoted context omitted.

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

Another method would be to show a user a list of all fields that are about to be filled in as part of the autocomplete prompt. This isn't very scalable for massive forms, but should be enough of an alert to a user that something is amiss on screen to make up for those cases.

I like this best too. All it does is add one more click (when you select the auto fill info, it pops up with all the data and you just approve) and it also solves a lot of wrong fills that can happen.

There's often sites that are poorly coded, and autofills ends up putting my phone number in some random field and I have to manually delete it.

Post reply on HN