61–70 of 173 posts
Earlier quoted context omitted.
If you use React, updating the value on every change is a very common pattern.
Hopefully most are updating the property and not the attribute.
ALWAYS browse with devtools open, and pay close attention to every packet that's being sent out (especially when you're not expecting any to...)
This isn't practical at all. Many websites perform hundreds of requests.
Earlier quoted context omitted.
No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y" no permutations needed
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
Earlier quoted context omitted.
No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y" no permutations needed
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
The real deal here is, it depends on some js code updating the dom for each key press, which is BAAAD. Not an useless keylogger, because it reminds a vulnerability product of choosing a bad decision.
This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
If you use React, updating the value on every change is a very common pattern.
Earlier quoted context omitted.
No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y" no permutations needed
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
To be really dangerous, I think this would need to defeat client-side cache strategies. If the browser caches each resource, the server-side reads wouldn't account for repeated characters or overall length with perfect accuracy. Consider palindromes like "racecar." This would still put many, if not most, passwords within guessable striking distance, for anyone able to intercept plain-text HTTP traffic, between Alice…