Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The war against autocomplete=off (2013)

blog.0xbadc0de.be

Post reply on HN
Print view View original

31–40 of 78 posts

Re: The war against autocomplete=off (2013)

#31

Post by ToastyMallows »

joshuahedlund wrote: post #28

> Tell me how I am supposed to fulfill these requirements if I need 20 websites daily to do my work ? One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I'…

I changed all my passwords recently to do the same thing. The problem I've recently started to see is that, let's say for example my hashed+salted password is stolen from a site. If they brute-force figure out what my password is, they'll have my "base word" and all my other accounts may still be able to be compromised.

Recently I changed my big accounts (Google, Facebook, StackOverflow) to have a slightly different "base word" and the other accounts that I can afford to lose control of have stayed the same.

Re: The war against autocomplete=off (2013)

#32

Post by ebiester »

joshuahedlund wrote: post #28

> Tell me how I am supposed to fulfill these requirements if I need 20 websites daily to do my work ? One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I'…

What do you do when you have to change a password for a site? Multiple algorithms?

Hrmmn... when did I last set this password?

Re: The war against autocomplete=off (2013)

#33

Post by brianpgordon »

I just use this bookmarklet to remove "autocomplete=off" from form elements:

javascript:(function(){var%20c=0;function%20R(w){try{var%20a,df,dfe,i,j,x,y,r=1;df=w.document.forms;for(i=0;x=df[i];++i){dfe=x.elements;if(a=x.onsubmit){a=""}if(a=x.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}for(j=0;y=dfe[j];++j){if(a=y.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}}}}catch(E){r=0}return%20r}R(self);var%20i,x;for(i=0;x=frames[i];++i)R(x);if(c){alert("Found:%20"+c)}})();

Re: The war against autocomplete=off (2013)

#34

Post by 6d0debc071 »

205guy wrote: post #14

The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patch…

> The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks.

Or, in its absence, take a look at the stickynotes and see all the password the person is using for everything. Or guess that the user's password is 'password' or something stupid like 'secret'

I mean I agree that it's a bad call for public computers to have it enabled by default. But among people's likely options I'd far sooner have them using even a bad password manager than what I perceive them to be likely to do in its absence - and from that perspective pretty much anything that lowers the likely adoption of password managers seems like a bad call.

I don't think that the larger population are going to find that FF's password manager doesn't work with a site and go running off to download KeePass or Lastpass or something like that. I think they're just going to shrug and type in 'password', (or some other dictionary word and a couple of numbers on the end - but in any case something re-used and simple,) for that site.

Re: The war against autocomplete=off (2013)

#35

Post by joshuahedlund »

ebiester wrote: post #32
joshuahedlund wrote: post #28

> Tell me how I am supposed to fulfill these requirements if I need 20 websites daily to do my work ? One solution to this problem (or at least one way to severely mitigate it) is to use a base word that you tweak with a simple algorithm based on the first letter, last letter, number of letters in the domain, etc. Of course some websites have mutually exclusive requirements, so this doesn't work for all sites, but I'…

What do you do when you have to change a password for a site? Multiple algorithms? Hrmmn... when did I last set this password?

Forced password changes are the biggest downside I've run into... I had to resort to a modified algorithm when LinkedIn was hacked, for instance. But for 90%+ of the websites I use it on, especially social networks and forums and the like, it's hardly ever an issue.

Re: The war against autocomplete=off (2013)

#36

Post by yonran »

brianpgordon wrote: post #33

I just use this bookmarklet to remove "autocomplete=off" from form elements: javascript:(function(){var%20c=0;function%20R(w){try{var%20a,df,dfe,i,j,x,y,r=1;df=w.document.forms;for(i=0;x=df[i];++i){dfe=x.elements;if(a=x.onsubmit){a=""}if(a=x.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}for(j=0;y=dfe[j];++j){if(a=y.attributes["autocomplete"]){if(a.value=="on"){c++}a.value="on"}}}}catch(E){r=0}return%…

There’s also the Chrome extension autocomplete=on from a Chromium author: https://chrome.google.com/webstore/detail/autocomplete-on/ec...

Re: The war against autocomplete=off (2013)

#37

Post by malandrew »

Could you not run an analysis of a user's password on account creation or password reset that determines if it is likely to be autogenerated and managed by a password manager. Then armed with this flag enable or disable autocomplete on a user by user basis with javascript?

Re: The war against autocomplete=off (2013)

#38

Post by stephengillie »

wyager wrote: post #3

I've run into the problem of web services not letting me store passwords. The reality is, if you let my password manager (safari jacks into OS X's keychain system) keep track of things, I'm going to use the random 12-digit alphanumeric password my password manager provides me. If you don't, I'm either going to use my shitty "brain" password or put it in my password manager anyway and just copy-paste it manually. Than…

I haven't encountered this issue in Windows with a 3rd party password manager, but I copypasta anyway because I don't like auto-entry.

Re: The war against autocomplete=off (2013)

#39

Post by wglb »

zyxley wrote: post #18
wglb wrote: post #6

The issue may be moot--IE 11 ignores autocomplete=off. And in any case, for the cases where this setting is effective, it doesn't break password managers--just set your password manager to not fill the fields, but use copy and paste for the password. [Edit - spelling]

I think you mean "moot", not "mute".

Thanks, fixed.

Re: The war against autocomplete=off (2013)

#40

Post by usea »

penguindev wrote: post #17

> Please note that if you combine this policy and at the same time disable copy and paste into the password fields (I look at you, Blizzard!), I hate you. oh man. disabling paste is the worst, because it breaks keypassx. (Apple did this last I checked!) turbotax did that as well last year, this year they made it sane again. Luckily there's a firefox about:config setting you can do to not let websites hijack / block y…

Another way to bypass these fields where you can't paste a password (many games are guilty of this atrocity): make an AutoHotkey[1] script for rapidly typing whatever is in your clipboard.

This line will make ctrl-alt-v type your clipboard:

^+v::SendRaw %clipboard%

[1] http://www.autohotkey.com/

Post reply on HN