Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#131

Post by whack »

StevePerkins wrote: post #122

If I weren't using autofill, then I would be re-using the same password for virtually every site. Because memorizing dozens or hundreds of strong passwords, many of which are forced to change periodically, is simply not humanly feasible. So pick your poison. Passwords suck, and you're vulnerable no matter how you approach them. Best you can do is 2FA or biometrics, and even that's not perfect either.

You can use a password manager to store unique passwords, without enabling autofill. I have autofill disabled in my password manager and have to click a button manually, in order to populate my credentials

Re: Autofill in password managers can allow login credentials to be stolen

#132

Post by noduerme »

throwawayboise wrote: post #65
noduerme wrote: post #53

Earlier quoted context omitted.

I mostly develop in-house business apps. So a prime example would be an application used at a shared corporate workstation. It's also not just about preventing credentials from leaking -- literally any form that is used by multiple users several times a day will start to accrete autofills, and that needs to be prevented. By the way, are you under the impression that most internet cafes scrub the browser autofill data…

A shared workstation should still be using separate user accounts, or an "anonymous" account that is completely reset (files, cache, browser history, etc.) between logins if there is some reason user accounts aren't possible.

Think hotel chain with 2-3 employees at a checkin desk, plus a manager on a personal laptop and a franchise owner on a tablet off-site. We have nowhere near that level of control even over front desk machines. Can't even dictate whether they're mac or pc. The software has to do all the heavy lifting of verifying each device by SMS confirmation with the managers, but we have no control over how the machines are set up... I don't think they'd even know how to create multiple user accounts, and if they did, no one would actually log out or follow security protocols anyway.

Re: Autofill in password managers can allow login credentials to be stolen

#133

Post by inyourtenement »

elpatokamo wrote: post #127

Besides convenience, one of the benefits of autofill is that it offers some implicit feedback about potential phishing sites. For example, your O365 credentials shouldn't autofill on off1ce.com. If I was on a site and noticed that my credentials didn't autofill (or offer autofill) when they normally would, this would immediately raise some red flags for me. The article does looks at how password managers autofill on…

Your first point doesn't really seem valid when comparing manual to automatic autofill. When I manually autofill, my password manager will show a suggested list of matching passwords. off1ce.com would not suggest my Office password, so I would still be alerted to a phishing site.

Re: Autofill in password managers can allow login credentials to be stolen

#134

Post by troyvit »

shrimp_emoji wrote: post #68
bakoo wrote: post #55

Earlier quoted context omitted.

Bitwarden has a hotkey to invoke autofill on a page. Not sure how much safer it actually is, but at least it feels like I'm in control.

It's safer as long as you don't hit it. (And, since the chance of you NOT hitting it is greater than zero, it can be called safer.) Hit it when logging in to HN. It will populate both the set of fields you've highlighted (login) as well as the other set on the page (register). If there were a third, hidden, injected set of fields controlled by an attacker, those would be filled too. The old security-convenience trade…

It seems like it would help if a password manager gave a warning before/instead of filling out multiple logins on one page. I log into a fair number of different sites in none of those do I want fill out multiple fields on the same page.

Re: Autofill in password managers can allow login credentials to be stolen

#135

Post by mikeryan »

noduerme wrote: post #132
throwawayboise wrote: post #65

Earlier quoted context omitted.

A shared workstation should still be using separate user accounts, or an "anonymous" account that is completely reset (files, cache, browser history, etc.) between logins if there is some reason user accounts aren't possible.

Think hotel chain with 2-3 employees at a checkin desk, plus a manager on a personal laptop and a franchise owner on a tablet off-site. We have nowhere near that level of control even over front desk machines. Can't even dictate whether they're mac or pc. The software has to do all the heavy lifting of verifying each device by SMS confirmation with the managers, but we have no control over how the machines are set up…

The problem here is your initial recommendations is to "Break autofill for everyone on your website so there's not a security risk in a very few edge cases".

Note all of those edge cases are on computers that should have Auto-fill disabled as part of an IT policy.

Re: Autofill in password managers can allow login credentials to be stolen

#136

Post by dunnevens »

PhantomGremlin wrote: post #47
earthboundkid wrote: post #43

Earlier quoted context omitted.

FieldNotesBrand.com Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.

A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tra…

In case of fire, seems like you only need to memorize the passwords for your email accounts. Everything else can be fixed with “reset your password” links.

I’ve sometimes wondered if that would be a useful security scheme. Using email as a de facto pw manager. Memorize your email pw. Use the password reset feature on your critical sites. It would be enormously inconvenient. But it would mean your passwords are never written down and never stored in a pw manager’s database.

Seems like that would make things more secure, but I’m probably overlooking something.

Re: Autofill in password managers can allow login credentials to be stolen

#137

Post by dbriles »

inyourtenement wrote: post #133
elpatokamo wrote: post #127

Besides convenience, one of the benefits of autofill is that it offers some implicit feedback about potential phishing sites. For example, your O365 credentials shouldn't autofill on off1ce.com. If I was on a site and noticed that my credentials didn't autofill (or offer autofill) when they normally would, this would immediately raise some red flags for me. The article does looks at how password managers autofill on…

Your first point doesn't really seem valid when comparing manual to automatic autofill. When I manually autofill, my password manager will show a suggested list of matching passwords. off1ce.com would not suggest my Office password, so I would still be alerted to a phishing site.

I'm not sure I follow - automatic autofill and manual autofill would both raise red flags by not automatically filling in credentials (automatic autofill) or not suggesting credentials (manual autofill).

edit: I think I understand. My first point doesn't show that automatic autofill is better than manual, because both methods will raise red flags. I.e. this isn't a reason to choose automatic over manual autofill. I think this is a fair point.

I do think that both autofill methods have an advantage over simple copy/paste, especially given the XSS discussion in other threads here.

Re: Autofill in password managers can allow login credentials to be stolen

#138

Post by MajorBee »

dylan604 wrote: post #57
MajorBee wrote: post #56

Earlier quoted context omitted.

They could very well store your card information even if they don't fraudulently charge you outright. They could even legitimize this action under the guise of server-side credit card number validation.

That's different than charging though. A lot different. There's no real way of knowing what goes on under the hood when putting your info into a web/app form like this, but if I was charged for something without pressing the actual buy button then "Houston, we have a problem".

True, that would certainly be not as worse and downright illegal as charging. It still seems very slimy, though -- why are you storing my CC details when I never actually made a purchase on your site?

Re: Autofill in password managers can allow login credentials to be stolen

#139

Post by PhantomGremlin »

dunnevens wrote: post #136
PhantomGremlin wrote: post #47

Earlier quoted context omitted.

A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tra…

In case of fire, seems like you only need to memorize the passwords for your email accounts. Everything else can be fixed with “reset your password” links. I’ve sometimes wondered if that would be a useful security scheme. Using email as a de facto pw manager. Memorize your email pw. Use the password reset feature on your critical sites. It would be enormously inconvenient. But it would mean your passwords are never…

It's a complicated issue.

I think some people don't make any real effort to keep track of their passwords, and so reset via email is kind of common.

But what if you're Sarah Palin, governor of some out-of-the-way state (pop. 736,000). Suddenly you're thrust into the spotlight as a VP candidate.

Sucks for her that Yahoo's password reset questions at the time were simple: The Yahoo! account's password could be reset using shared secret questions including "where did you meet your spouse?" along with the date of birth and ZIP code of the former governor to which answers were easily available online.

https://en.wikipedia.org/wiki/Knowledge-based_authentication

Can you trust your email provider not to let your account get "stolen" from you?

I think having a discussion like this on HN is great. It gives people an opportunity to re-evaluate their current procedures.

Re: Autofill in password managers can allow login credentials to be stolen

#140

Post by purplecats »

joenathanone wrote: post #45
purplecats wrote: post #20

Earlier quoted context omitted.

yeah i have it autofill (its a feature now) but it doesnt auto login. so i built an extension that waits for it to fill it in and then performs some safety checks and then logs in. finally the bliss i had with lastpass before i was forced to move to bitwarden.

Can I get me some of that extension? https://i.pinimg.com/originals/cb/14/5d/cb145d466f1958ec101f...

here you go https://hastebin.com/cezuyehaxo.js
Post reply on HN