Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Browser Security Warnings with Pseudo Password Fields

troyhunt.com

Post reply on HN
Print view View original

51–60 of 127 posts

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#51

Post by scaryclam »

atesti wrote: post #42

Nice trick. Can it be used to stop password managers? Our system works over HTTPS and saving the password to login is okay of course, password managers are great and they must obey the user, not the page. But on sone pages of the system one has to enter credentials for other systems using password fields. Chrome always wants to remember these and prefills it with the login data to our system. Can this be stopped? May…

Have you tried adding:

autocomplete="new-password"

to the field? This is supposed to stop Chrome autofilling the value

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#53

Post by Xylakant »

Tijdreiziger wrote: post #35
metilda wrote: post #10

Earlier quoted context omitted.

VOIP and specifically SIP in its least secure form became the replacement for old tandem circuits. Sadly, rather than pushing SIP hardware out to the endpoints, most lamdline carriers chose to just provide twisted pair service. VoLTE is as close as most consumers will get to proper VOIP service.

Giving everyone SIP phones is expensive, and forcing your subscribers to purchase SIP phones will ensure a number of them flee to the competition. Putting the VOIP hardware in the modem makes much more sense, because you have to provide that to your subscribers anyway.

I actually have my own Cisco Phone adapter to connect my old analog phone/answering machine. I'd assume that a true SIP phone would work as well. What's questionable is whether I could authenticate from a different network than my home network.

I know, however, that both Vodafone and Telekom in Germany offer products that allow connecting VOIP phones from anywhere to a virtual phone appliance.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#54

Post by Xeoncross »

acdha wrote: post #50
snowpanda wrote: post #40

Earlier quoted context omitted.

That makes more sense than trying to force a completely unrelated opinion into a conversation. Also, the notion that broad use of IPv6 = security in VOIP, IoT or any area is a postulation at best. I've personally always found this to be a good overview of security issues involved in both protocols in VOIP: http://ieeexplore.ieee.org/abstract/document/6714161/ (Sci-Hub approved) There are certain parts of the industry…

It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.

As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries.

The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#55

Post by jldork »

distances wrote: post #3
StudentStuff wrote: post #2

If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone number dialed, keys pressed during the call, codec to use) and call media over the internet raw, just hoping that no one eavesdrops or alters their data. HIPPA compliance? Nah bruh, unencrypted UDP is just fine! PCI-DSS says we can't take credit cards over this w…

What are VOIP systems used for these days? Private enthusiasts or some company call centers? I've no idea, as I haven't seen one for at least half a decade now -- even all conference calls are always over Skype or Hangouts.

I've seen a lot of tech companies use appear.in or talky.io for their VoIP conferencing as well

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#56

Post by rwbcxrz »

josteink wrote: post #43
jakub_g wrote: post #37

Earlier quoted context omitted.

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope ) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business .

> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?

I used to have internet from Cox Communications. One day when I was working from home, I was surprised to see a page in my local dev environment load with an overlay telling me my ISP thinks I have a Windows virus (I didn't own any Windows machines at the time).

Turns out our dev environment didn't force CDN assets to load over HTTPS, so my ISP injected some JS into a library we were loading.

I tweeted at them, and they not only verified that it came from them, but also that they consider hijacking and modifying my traffic to be a service.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#57

Post by throwaway2016a »

saas_co_de wrote: post #6

"I’ve been speaking with the owner about SSL before I invest in becoming a member, but she’s been told by the dev of the platform (it’s a franchise system called ShopCity.com) that SSL is more about Google’s monopolizing visibility of content, and less to do with security" This is an interesting observation of how Google's technical crusades often align with its profit interests. The main threat that HTTPS everywhere…

> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you.

That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password.

HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack.

Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too.

Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#58

Post by acdha »

Xeoncross wrote: post #54
acdha wrote: post #50

Earlier quoted context omitted.

It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.

As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy…

> As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries.

Those are big claims without any supporting evidence. From the sounds of it, you're repeating the anti-vax claims about mercury.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#59

Post by BuuQu9hu »

StudentStuff wrote: post #2

If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone number dialed, keys pressed during the call, codec to use) and call media over the internet raw, just hoping that no one eavesdrops or alters their data. HIPPA compliance? Nah bruh, unencrypted UDP is just fine! PCI-DSS says we can't take credit cards over this w…

HIPAA, not HIPPA.

https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#60

Post by notheguyouthink »

snowpanda wrote: post #40
metilda wrote: post #24

Earlier quoted context omitted.

Pretty sure that means people who refuse to deploy TLS & IPv6, even when their hardware & software stack fully supports it.

That makes more sense than trying to force a completely unrelated opinion into a conversation. Also, the notion that broad use of IPv6 = security in VOIP, IoT or any area is a postulation at best. I've personally always found this to be a good overview of security issues involved in both protocols in VOIP: http://ieeexplore.ieee.org/abstract/document/6714161/ (Sci-Hub approved) There are certain parts of the industry…

> That makes more sense than trying to force a completely unrelated opinion into a conversation.

I'm curious, at what point does that opinion become fact? Isn't the evidence overwhelming?

I mainly ask because it feels like if the evidence for vaccination were not sufficient to warrant it as more than simply an opinion, wouldn't many other things become merely opinion too?

Post reply on HN