91–100 of 173 posts
Couldn't Content Security Policy (CSP) [1] be used to mitigate this attack? [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
It actually can't. Instagram does use this protect java-script injection from extensions, but clearly injecting CSS is allowed.
Someone else in this thread suggested that as well.
Earlier quoted context omitted.
If you use React, updating the value on every change is a very common pattern.
Hopefully most are updating the property and not the attribute.
this.input.value = 'password';
Earlier quoted context omitted.
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
Even if the attacker got them out of order, it would let them be able to brute force guess in a small number of attempts.
Earlier quoted context omitted.
Something like conditional formatting maybe? Eg. make negative values red? Make an input field red when it contains an invalid character?
Sounds like the pattern attribute and :invalid selector on will do that. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in...
Another example where reading the input might be nice:
input[type="cc-number"][value^="4"]+.cc-system-icon {
background-image: url('visa.png');
}input[type="cc-number"][value^="5"]+.cc-system-icon {
background-image: url('master-card.png');
}This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…
If you do control the page, there may not be that many reasons, but if you only have a limited entry-point, this is very interesting.
Earlier quoted context omitted.
No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y" no permutations needed
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
I hate the internet.
(Truth to tell, advertisers had their fangs on even the barest 'social media' thing like Usenet, where "spam" not in a tin can was first defined.)
Earlier quoted context omitted.
Even if the attacker got them out of order, it would let them be able to brute force guess in a small number of attempts.
For example, there are about 41,000 possible passwords for a given set of 8 characters, out of around 96^8 possible 8 character passwords (in the ASCII character set).
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
If you use React, updating the value on every change is a very common pattern.
Earlier quoted context omitted.
For example, there are about 41,000 possible passwords for a given set of 8 characters, out of around 96^8 possible 8 character passwords (in the ASCII character set).
Where does 41000 come from?
This is 127,286,426,869 (~128bn) times smaller than 92^8.
Edit: Note that if you have a repeated character in your 8 charcter password then the number of permutations of the set of 8 (7 distinct) characters is further halved to 20,160.