Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Browser Security Warnings with Pseudo Password Fields

troyhunt.com

Post reply on HN
Print view View original

41–50 of 127 posts

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#41

Post by josteink »

saas_co_de wrote: post #6

"I’ve been speaking with the owner about SSL before I invest in becoming a member, but she’s been told by the dev of the platform (it’s a franchise system called ShopCity.com) that SSL is more about Google’s monopolizing visibility of content, and less to do with security" This is an interesting observation of how Google's technical crusades often align with its profit interests. The main threat that HTTPS everywhere…

> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you.

As someone living in Europe, this literally happens nowhere. Because it's illegal.

SSL in browser has nothing to do with our ISPs. Stop being US-centric.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#42

Post by atesti »

Nice trick. Can it be used to stop password managers? Our system works over HTTPS and saving the password to login is okay of course, password managers are great and they must obey the user, not the page. But on sone pages of the system one has to enter credentials for other systems using password fields. Chrome always wants to remember these and prefills it with the login data to our system. Can this be stopped? Maybe by using this font

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#43

Post by josteink »

jakub_g wrote: post #37
saas_co_de wrote: post #6

"I’ve been speaking with the owner about SSL before I invest in becoming a member, but she’s been told by the dev of the platform (it’s a franchise system called ShopCity.com) that SSL is more about Google’s monopolizing visibility of content, and less to do with security" This is an interesting observation of how Google's technical crusades often align with its profit interests. The main threat that HTTPS everywhere…

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope ) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business .

> I don't want my ISP to inject JavaScript to random pages or analyze my traffic.

I haven't seen a single reputable ISP do this anywhere. It would illegal.

Is the US really such a third world nation that not even basic regulation like this exist?

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#44

Post by annabellish »

kgbme wrote: post #31
nerdponx wrote: post #23

Earlier quoted context omitted.

Perhaps, but it's fairly easy to un-Google your life nowadays.

Except, it shouldn't take work!.. Like - with cell phones. Until recently, I had no idea that manufacturers actually PAY Google to have the services on Android... Talk about idiocy.

It doesn't seem like idiocy to gain access to the largest application ecosystem available for their product.

I mean, you _could_ go the amazon route, but how's that working out for them? Their mobile platform is not exactly flourishing. An Android device without Google Apps simply isn't going to sell in the millions.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#45

Post by josteink »

robteix wrote: post #19
jenscow wrote: post #14

Surely it would be easier to just get a cert. What's preventing these types from doing so?

I believe it's either (a) a lack of understanding of _why_ one should use SSL or (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a)

> (b) a mistaken sense of principle of standing up to the perceived bulliness of Google, which, come to think of it, it's basically an application of (a)

But Google has been bullying around with their behaviour. I don't think that's even debatable.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#46

Post by js2 »

deckar01 wrote: post #33

This hack is exactly what I needed 2 days ago while working on a browser-based terminal app. My site will be secured with SSL/TLS, but I needed a way to make a content-editable span mask input like a password field. I already implemented it with a password input, but it doesn't wrap inline like a span does. It will be much cleaner to just add a class that masks the font.

A password field does more than just mask input. At least on macOS, it's also a secure input field where the OS ensures no other applications can see what is entered. Simply masking the font will imply to the user that their input is secure, when in fact it is not.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#47

Post by eadmund »

lwansbrough wrote: post #20

No need for the JS, just change the font if the input isn't empty, right?

Yeah, but this is 2017, when we can't even display images or text on a webpage without JavaScript. Why do in a few characters of CSS what can be done in kilobytes of remotely-executed JavaScript?

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#48

Post by pritambaral »

josteink wrote: post #43
jakub_g wrote: post #37

Earlier quoted context omitted.

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope ) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business .

> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?

US Cable companies in the past have injected alerts into unsecured sites users browsed, to tell them they're running out of data. If they could do that, they could inject ads too.

US Mobile companies inject identification headers in unsecured HTTP calls, for advertiser tracking; and in other cases allow servers to ping the user's IP back to the ISP to get full details of the user (including addresses).

The regulatory agents responsible for regulating the cable and mobile companies in the US are right now hellbent on removing net neutrality and are fighting against the consumer. Fat chance of those "basic regulation"s existing or surviving.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#49

Post by FRex »

josteink wrote: post #43
jakub_g wrote: post #37

Earlier quoted context omitted.

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope ) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business .

> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?

Apparently it's a thing:

https://www.infoworld.com/article/2925839/net-neutrality/cod...

https://blog.ryankearney.com/2013/01/comcast-caught-intercep...

https://www.fastcompany.com/3023305/att-offers-discounted-gi...

https://arstechnica.com/information-technology/2016/09/att-t...

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#50

Post by acdha »

snowpanda wrote: post #40
metilda wrote: post #24

Earlier quoted context omitted.

Pretty sure that means people who refuse to deploy TLS & IPv6, even when their hardware & software stack fully supports it.

That makes more sense than trying to force a completely unrelated opinion into a conversation. Also, the notion that broad use of IPv6 = security in VOIP, IoT or any area is a postulation at best. I've personally always found this to be a good overview of security issues involved in both protocols in VOIP: http://ieeexplore.ieee.org/abstract/document/6714161/ (Sci-Hub approved) There are certain parts of the industry…

It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.
Post reply on HN