Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I know your name, where you work, and live (Safari v4 & v5)

jeremiahgrossman.blogspot.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: I know your name, where you work, and live (Safari v4 & v5)

#21

Post by roryokane »

retube wrote: post #17

> These fields are AutoFill’ed using data from the users personal record in the local operating system address book. Sorry, maybe a stupid question, but can someone explain this? I had no idea my OS had an address book. Why does it have this? If it does, how do I put stuff in it? Or delete stuff in it? Is this just on mac, or windows and linux too?

On Mac, there is an application called Address Book in the Applications folder. It comes with the OS so as to allow apps to integrate with it. Such apps include Safari, as we have seen, and Mail (the email program). Adding and editing contacts should be obvious from the interface – click a + at the bottom to add a new contact or contact group. I don’t know if Windows or Linux have address books.

Re: I know your name, where you work, and live (Safari v4 & v5)

#22

Post by roryokane »

The demo doesn’t work for me – it can’t detect my information at all. I’m using Safari Version 5.0 (6533.16), have the red-circled autofill setting enabled (and no other autofill settings), and have information about myself in my address book card.

Re: I know your name, where you work, and live (Safari v4 & v5)

#23

Post by mseebach »

loewenskind wrote: post #15
natmaster wrote: post #10

Earlier quoted context omitted.

Autocomplete by other browsers works by remembering things you entered in forms previously (maybe restricted to domain?). One distinction is that you already decided you wanted to expose that information. The most important distinction though, is that you have to still select to fill that out manually. Of course logins are another story - those are automatically filled in. But those are restricted to the page you alr…

Couldn't you still use a variation of this hack to steal the info from Firefox? Steps: 1. Go to a popular site that makes one fill out the information you want to steal. 2. Record the name they use for all their fields (afaik this is how FF determines what value to supply) 3. Use the hack to make a form with those fields 4. Profit On step 3, it may be that you have to enter the field and type something to get the aut…

Step 3.5: Get the user to activate auto-complete (start typing, or just arrow-down) and select an item from the list on each field.

Re: I know your name, where you work, and live (Safari v4 & v5)

#24

Post by natmaster »

loewenskind wrote: post #15
natmaster wrote: post #10

Earlier quoted context omitted.

Autocomplete by other browsers works by remembering things you entered in forms previously (maybe restricted to domain?). One distinction is that you already decided you wanted to expose that information. The most important distinction though, is that you have to still select to fill that out manually. Of course logins are another story - those are automatically filled in. But those are restricted to the page you alr…

Couldn't you still use a variation of this hack to steal the info from Firefox? Steps: 1. Go to a popular site that makes one fill out the information you want to steal. 2. Record the name they use for all their fields (afaik this is how FF determines what value to supply) 3. Use the hack to make a form with those fields 4. Profit On step 3, it may be that you have to enter the field and type something to get the aut…

Autocomplete is activated by user interaction, not javascript events. The only way to trigger this would be a phishing attack, where you tricked the user into entering their information in.... but in that case, you're not really benefiting from autocomplete because they would have given it to you anyway.

Re: I know your name, where you work, and live (Safari v4 & v5)

#27

Post by bruceboughton »

loewenskind wrote: post #16

Since this is a problem in the JS handling (as mention in another comment in this thread, Safari isn't differentiating between keyboard entries that were generated from JS from ones that actually came from a keyboard), that's probably in Webkit itself and therefor fixable by the community, no?

That doesn't help with an actual Safari release though, does it?

Re: I know your name, where you work, and live (Safari v4 & v5)

#28

Post by bkrausz »

cubicle67 wrote: post #25

completely unrelated - didtrade http://news.ycombinator.com/user?id=didtrade has been spamming HN for 21 days now, but they're still not banned?

I was trying to think of how to ask that myself. I guess just auto-deleting whatever they post (if that's actually what's happening) is better than banning them, since a ban would alert them and they can just make a new account. This lets them continue spamming nobody (except showdead folk).

Re: I know your name, where you work, and live (Safari v4 & v5)

#29

Post by mike-cardwell »

roryokane wrote: post #22

The demo doesn’t work for me – it can’t detect my information at all. I’m using Safari Version 5.0 (6533.16), have the red-circled autofill setting enabled (and no other autofill settings), and have information about myself in my address book card.

Didn't work for me until I went into the address book, selected my contact and then clicked "Make this my card". I'm using the same version of Safari as you.
Post reply on HN