Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser auto-fill phishing

github.com

Post reply on HN
Print view View original

101–110 of 150 posts

Re: Browser auto-fill phishing

#101

Post by alexdoma »

athenot wrote: post #7
aesthetics1 wrote: post #2

Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

This is exactly how signing in to gmail works if the browser has the credentials of the account saved.

Initially only the input field for e-mail is displayed. There's also a, hidden to the user's eyes, _next step_ with the password field that gets populated if the browser auto-fills it.

Re: Browser auto-fill phishing

#103

Post by teddyh »

ris wrote: post #59
jonknee wrote: post #21

Earlier quoted context omitted.

> So the browser would have to determine if the item is visible to the user, which is not trivial This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

http://www.catb.org/jargon/html/F/Flyspeck-3.html

Re: Browser auto-fill phishing

#106

Post by greenhatman »

aesthetics1 wrote: post #2

Wow, great demonstration. I'd never thought about this being exploited. I wonder if the fix could be something as simple as the browser only allowing non-hidden [Edit: "not visible to the user", I should have said, as this does not appear to auto-fill ] fields to be auto-filled. Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?") has…

Is it possible for JavaScript to trigger key presses on input boxes? Probably not.

If it was you could write a script to automatically post all auto fill data on page load.

Re: Browser auto-fill phishing

#107

Post by greenhatman »

tiglionabbit wrote: post #51
alexwebb2 wrote: post #15

Earlier quoted context omitted.

No need for a submit click. Presumably auto-fill triggers a change event on each affected input, but even if it didn't, an attacker could just repeatedly check for new content in the inputs. This means an optimistic solution (autofilling and then unobtrusively notifying the user what was autofilled) is not viable.

Notice that it's not checking the data with JavaScript. I was under the impression that there is already a security measure against this as far as JavaScript is concerned. The browser is already instructed to lie to JavaScript about certain details such as the :visited state of a link and any CSS rules that follow as a result of this.

Even if you can't read the values with JavaScript, you can submit the form with JavaScript.

So then you'd need to prompt the users to confirm that they want to auto fill, not just notify that auto fill happened. Otherwise it may already be too late.

Re: Browser auto-fill phishing

#108

Post by thecrazyone »

vxNsr wrote: post #77
Raphmedia wrote: post #36

Earlier quoted context omitted.

Well, then simply make them height:0px or put a with a white background over it. Change the input and make it text-color: white; background-color: white; Change it's z-index to be lower than your other elements, etc.

This makes the case that auto fill just ain't that secure, I guess if we use it we just need to accept that.

There's no need to "just accept" that it's not secure. We need to make it secure. This is a tedious/hard problem, yes. IMHO we've (people) solved tougher problems :)

Re: Browser auto-fill phishing

#109

Post by ycmbntrthrwaway »

jaxomlotus wrote: post #42
athenot wrote: post #7

Earlier quoted context omitted.

The elements are not hidden, they are just drawn off the screen. So the browser would have to determine if the item is visible to the user, which is not trivial. Should autofill skip regular form elements that are just a little below the viewport? Maybe some feedback from the browser detailing which datapoints were autofilled. I don't know...

Another method would be to show a user a list of all fields that are about to be filled in as part of the autocomplete prompt. This isn't very scalable for massive forms, but should be enough of an alert to a user that something is amiss on screen to make up for those cases.

You can scale it by classifying fields into groups. Then user can decide gradually if he wants to share his name. Later, application may ask for location (browsers can already do this), employer info, contact data etc.

What is needed is integration with permission granting mechanisms, which already exist in browsers.

Re: Browser auto-fill phishing

#110

Post by matthberg »

ris wrote: post #59
jonknee wrote: post #21

Earlier quoted context omitted.

> So the browser would have to determine if the item is visible to the user, which is not trivial This is not terribly difficult, browsers need to know what is visible because they have to actually display it. If an element isn't drawn it shouldn't be autofilled.

Adobe made a font like this, adobe blank: https://github.com/adobe-fonts/adobe-blank
Post reply on HN