Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

111–120 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#111

Post by jsmith99 »

yosito wrote: post #52
emodendroket wrote: post #9

Earlier quoted context omitted.

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

Yes but there is very low correlation of risk - much less than if your password manager is online.

Re: Autofill in password managers can allow login credentials to be stolen

#112

Post by eganist »

chill1 wrote: post #110
crazygringo wrote: post #50

I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient. If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways . If a site is vulnerable to XSS it's basically game over security-w…

> If a site is vulnerable to XSS it's basically game over security-wise. Another reply seems to have focused on having XSS causing an attacker to gain access to session cookies. But no one has mentioned using Content-Security-Policy [0] - which if set properly can make it nearly impossible to exploit an XSS vulnerability in the first place. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

csp is basically only useful when eng teams don't rely on unsafe-inline and unsafe-eval as a crutch.

which far, far too many apps do.

Re: Autofill in password managers can allow login credentials to be stolen

#113

Post by tremon »

maccard wrote: post #101
usrusr wrote: post #99

Earlier quoted context omitted.

Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.

So security through obscurity?

I'd call it security through diversity.

Re: Autofill in password managers can allow login credentials to be stolen

#114

Post by zenexer »

I was fully prepared to berate this article for encouraging manual copy-pasting, which makes people far more prone to phishing attacks. However, it makes this important clarification:

> Autofill can be 2 types: automatic autofill (autofilling a password without user interaction) and manual autofill (autofilling a password after some user interaction - clicking in the password manager's UI). In the following article, the term autofill always means automatic autofill.

Re: Autofill in password managers can allow login credentials to be stolen

#116

Post by vgalin »

throwawayboise wrote: post #62
PhantomGremlin wrote: post #47

Earlier quoted context omitted.

A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tra…

Do you have your password manager database and private keys backed up in a way that would survive if you have a fire? A lot of people may think they have backups of stuff like this but unless you remember to grab that thumb drive out of your desk drawer (assuming you're home) a fire might still destroy them.

It should be reasonably safe to store database files on various cloud storages. If you are not willing to do so, it is also possible to keep them on flash drives at your relatives' homes.

Re: Autofill in password managers can allow login credentials to be stolen

#117

Post by stabbles »

system2 wrote: post #88

God bless KeePass. Never have to deal with these. I just double click and ctrl+v whenever I need to use a pass. Takes extra 3 seconds but I feel like I am not giving anything to the browsers to save.

Now your security issue is other applications accessing your clipboard.

I'm quite aware of this ever since Samsung/Android started adding a whole interface for the clipboard and added integration with the keyboard (it shows some codes in the clipboard sometimes so you can quickly paste). Can the clipboard be accessed from other apps in the background? Probably?

Re: Autofill in password managers can allow login credentials to be stolen

#118

Post by emodendroket »

mjthompson wrote: post #107
NavinF wrote: post #100

Earlier quoted context omitted.

If someone sees a list of site/user/pass, wouldn't they take a photo of it instead of stealing the entire notebook? It just seems like the obvious thing to do. >They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA Did you get that from CSI: Miami? Nobody is gonna collect DNA samples just because some stuff went…

Burglars are in and out in a matter of minutes. There's no way they're standing there taking photographs. Like I said, they want money (and easily hocked valuables). No street criminal is interested in your Google Account login. Australian here. When my house was broken into Police forensics came that afternoon and fingerprint dusted all points of entry and lifted prints. Do they not do this in your jurisdiction? I h…

Honestly the American cops are unlikely to bother with that. But still, I agree that a burglar is unlikely to bother with your password notebook.

Re: Autofill in password managers can allow login credentials to be stolen

#119

Post by emodendroket »

maccard wrote: post #94
dredmorbius wrote: post #78

Earlier quoted context omitted.

That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within r…

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offl…

If you want a local one, Keepass will do.

Re: Autofill in password managers can allow login credentials to be stolen

#120

Post by tialaramex »

valenterry wrote: post #59
tialaramex wrote: post #37

Earlier quoted context omitted.

Under WebAuthn you can have 2FA despite only one authentication flowing from your authenticator to the web site. Nice smartphones (say, a modern Pixel or an iPhone) with fingerprint readers, have as the two factors your fingerprint (something you are) and the phone itself (something you have). The phone signs your authentication, the private information (your fingerprint) never leaves the phone, it just warrants that…

What if the phone is fully compromised?

What about it?

If your threat model is "People fully compromised my phone" then you should definitely not rely on the phone in the face of that.

Post reply on HN