Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

101–110 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#101

Post by maccard »

usrusr wrote: post #99
maccard wrote: post #94

Earlier quoted context omitted.

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offl…

Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.

So security through obscurity?

Re: Autofill in password managers can allow login credentials to be stolen

#102

Post by pbhjpbhj »

usrusr wrote: post #99
maccard wrote: post #94

Earlier quoted context omitted.

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offl…

Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.

Security through obscurity, in other words (I've always been a fan, it works as an additional factor; not being sarcastic!).

Re: Autofill in password managers can allow login credentials to be stolen

#103

Post by dredmorbius »

maccard wrote: post #94
dredmorbius wrote: post #78

Earlier quoted context omitted.

That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within r…

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offl…

Not being dependent on some external maintainer outside your preferred editor and encryption tools.

The ability to port to any alternative tools that provide superior capabilities, should the need arise.

Utilising the file using standard shell tools (gpg piped to grep, sed, awk, etc.).

I've been around long enough to see multiple tools come and go. Even PGP itself dates from after the beginning of my professional career with computers (though near the beginning). There are multiple applications, operating systems, and architectures I've used which have been relegated to the dustbin of history. I'm quite leery of becoming dependent on any one specific application or tool, most especially one that that's not been proven across multiple decades and widely adopted.

PGP, GPG, vi/vim, or emacs would all pass my tests. They're available on any system I could conceivably use. Even iOS, though with some difficulty.

Encrypting and syncing a file is simple.

Managing syncs from multiple locations of an encrypted file is ... a bit more complicated. Git might be able to manage that with some hooks.

Re: Autofill in password managers can allow login credentials to be stolen

#104

Post by usrusr »

maccard wrote: post #101
usrusr wrote: post #99

Earlier quoted context omitted.

Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.

So security through obscurity?

Yes, obscurity is great when used as an additional factor.

Re: Autofill in password managers can allow login credentials to be stolen

#105

Post by nmstoker »

I'm confused because on my Pixel 4 where I use the built-in password manager (for Chrome and for apps) you always have to interact with the UI (not just the site) to agree to fill in the password but it's not at all inconvenient and sounds like it wouldn't allow the sort of weaknesses that the article describes. I confirmed on a site that i know has only one set of credentials stored (so it wasn't giving me a false sense of security due to that). Is there more than one form of Google password manager available, ie a regular version and a Pixel version?

Re: Autofill in password managers can allow login credentials to be stolen

#107

Post by mjthompson »

NavinF wrote: post #100
mjthompson wrote: post #63

Earlier quoted context omitted.

> A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they d…

If someone sees a list of site/user/pass, wouldn't they take a photo of it instead of stealing the entire notebook? It just seems like the obvious thing to do. >They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA Did you get that from CSI: Miami? Nobody is gonna collect DNA samples just because some stuff went…

Burglars are in and out in a matter of minutes. There's no way they're standing there taking photographs. Like I said, they want money (and easily hocked valuables). No street criminal is interested in your Google Account login.

Australian here. When my house was broken into Police forensics came that afternoon and fingerprint dusted all points of entry and lifted prints. Do they not do this in your jurisdiction? I have just realised DNA is probably poor shorthand for that.

Re: Autofill in password managers can allow login credentials to be stolen

#108

Post by mcintyre1994 »

jefftk wrote: post #27
TedDoesntTalk wrote: post #23

I don’t see the vulnerability. His demo collects credentials then displays them ... all on the same domain websecurity.dev So what? What am I missing? How will he exfiltrate the data? With JS that posts it to another domain?

If the attacker has XSS and gets the password, exfiltration is the easy part. JS offers many options, starting with fetch.

If they can run arbitrary JS on the site, can't they just change the target of the login form to their own server and exfiltrate credentials whether you used a password manager to fill them in or not? I'd be much more interested if you could exfiltrate without arbitrary JS, maybe in an img embed with the password injected into the URL or something?

Re: Autofill in password managers can allow login credentials to be stolen

#109

Post by hklutryhgg »

tmsbrg wrote: post #96
hklutryhgg wrote: post #91

Earlier quoted context omitted.

> If some site has an XSS vulnerability, then they've already got access to my session cookies Not true if the website uses HttpOnly session cookies as they should.

They don't need your session cookie either. An attacker can just use XmlHttpRequest to perform any actions as you on the website, and read the web page results. E.g. go to your profile and steal all your personal data. They can also set up a keylogger or fake login screen and wait for you to type or paste in your password yourself. I've always thought HttpOnly cookie flag is overrated. Stealing the session cookie may…

I'm pretty sure you can defend against this with javascript script hashes and restrictive CSR's, but yeah, they are quite involved to setup.

Re: Autofill in password managers can allow login credentials to be stolen

#110

Post by chill1 »

crazygringo wrote: post #50

I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient. If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways . If a site is vulnerable to XSS it's basically game over security-w…

> If a site is vulnerable to XSS it's basically game over security-wise.

Another reply seems to have focused on having XSS causing an attacker to gain access to session cookies. But no one has mentioned using Content-Security-Policy [0] - which if set properly can make it nearly impossible to exploit an XSS vulnerability in the first place.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Post reply on HN