Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

31–40 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#31

Post by red369 »

blockarchitech wrote: post #2

I like password managers. It keeps people from writing them down on your desk or a notepad, so I'm all for it. I hate autofill. Any form of autofill, automated, user request, any of it. I would like people to just use a small button to open a 'mini instance' of the password manager, like an instant app (or app clips for iphones), and copy your password that way. Autofill is also a huge security risk, excluding if the…

I agree with much of what you said, but I think there is another advantage of autofill which I think copy and paste misses out on. If autofill usually works perfectly day after day, and then one day it fails, for example because the password manager fails to match the URL on a phishing site, its an extra clue that it's not the correct site. Of course this also works with non-automatic autofill, and the importance of the autofill failing could easily be overlooked anyway.

Re: Autofill in password managers can allow login credentials to be stolen

#32

Post by itsananderson »

emodendroket wrote: post #24
itsananderson wrote: post #19

Earlier quoted context omitted.

True, if an attacker has control of your device you are probably screwed anyway, but there are still different degrees of screwed. There are more and less privileged portions of your system, and keeping sensitive data to less secure areas is still not a great idea. With browsers offering clipboard access as a JavaScript API, it is definitely an area I would consider less well secured than, say, read protected memory…

Fair point, but I don't think you can _read_ the contents of the system clipboard, can you? I thought you could set it but had to wait for a paste event to read it.

It requires a permission request, but yes there's a browser API to read the clipboard contents https://developer.mozilla.org/en-US/docs/Web/API/Clipboard/r...

Re: Autofill in password managers can allow login credentials to be stolen

#33

Post by joshuaavalon »

rvz wrote: post #22
ishtanbul wrote: post #14

Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill

Well it still recognises to autofill in the password on a different subdomain as shown in the PoC by default, which is not good at all. To Downvoters: So in the PoC [0] with the default settings the author is completely wrong about their findings? even if you 'manually' autofill in the fields? So you are saying that the password DOESN'T get extracted out of Bitwarden from a different subdomain than where the login da…

There is a setting in URL of the password called "Match Detection"[1]. You can change it to "Host" if don't want it to match subdomain.

[1]: https://bitwarden.com/help/article/uri-match-detection/#matc...

Re: Autofill in password managers can allow login credentials to be stolen

#34

Post by sitkack »

ericd wrote: post #12
emodendroket wrote: post #9

Earlier quoted context omitted.

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

Time to revive the rolodex...

With a polarizing filter, oled display, vision based user recognition and a nice haptic knob, hopefully in some sort of upcycled oak, alder or white ash.

Re: Autofill in password managers can allow login credentials to be stolen

#35

Post by noduerme »

Not mentioned in the article -- a good way to prevent Chrome from ever recognizing the "same" field and attempting to autofill it is to include and randomize a "name=" attribute on all tags, or else name them with a string including a unique user id. This should always be done on web apps. Otherwise the next user on a public computer will see autofill options from previous users.

Re: Autofill in password managers can allow login credentials to be stolen

#36

Post by mikeryan »

noduerme wrote: post #35

Not mentioned in the article -- a good way to prevent Chrome from ever recognizing the "same" field and attempting to autofill it is to include and randomize a "name=" attribute on all tags, or else name them with a string including a unique user id. This should always be done on web apps. Otherwise the next user on a public computer will see autofill options from previous users.

I’d prefer if you didn’t. I like 1Password knowing where to put my credentials when I ask it to.

Re: Autofill in password managers can allow login credentials to be stolen

#37

Post by tialaramex »

bmurphy1976 wrote: post #13
mjthompson wrote: post #6

Good advice. Ever since Tavis Ormandy set his sights on password managers, I have been a very sceptical user. I still use 1Password, but without the browser extension. Putting autofill aside, there's a couple of other concerns I have. I am hesitant about recommending a password manager to the tech illiterate simply because one piece of malware could compromise the entire vault. In that respect, a sticky note is argua…

You still need 2FA and the 2FA absolutely should NOT be a part of your password manager. Use a different app at the very least. This should help alleviate some of the worst password manager risks.

Under WebAuthn you can have 2FA despite only one authentication flowing from your authenticator to the web site. Nice smartphones (say, a modern Pixel or an iPhone) with fingerprint readers, have as the two factors your fingerprint (something you are) and the phone itself (something you have). The phone signs your authentication, the private information (your fingerprint) never leaves the phone, it just warrants that it checked it (UV bitflag in the signed data)

Or say you have a FIDO 2 Security Key from Yubico. As well as the features of the cheaper FIDO 1 Security Key products, this has a PIN verifier. The PIN is something you know, while the Security Key itself is something you have, so that's two factors, once again the UV bitflag is signed.

It's simpler, it's easier, it's more secure. And yet, right now I bet an HN reader is implementing yet another shitty SMS-as-2FA hack and we're still in a thread about remote authenticating with passwords - an idea that was already terrible in the 1970s.

Re: Autofill in password managers can allow login credentials to be stolen

#38

Post by geoka9 »

sitkack wrote: post #34
ericd wrote: post #12

Earlier quoted context omitted.

Time to revive the rolodex...

With a polarizing filter, oled display, vision based user recognition and a nice haptic knob, hopefully in some sort of upcycled oak, alder or white ash.

Don't forget wifi connectivity...

Re: Autofill in password managers can allow login credentials to be stolen

#39

Post by lmohseni »

geoka9 wrote: post #38
sitkack wrote: post #34

Earlier quoted context omitted.

With a polarizing filter, oled display, vision based user recognition and a nice haptic knob, hopefully in some sort of upcycled oak, alder or white ash.

Don't forget wifi connectivity...

A web based admin interface might be handy as well...

Re: Autofill in password managers can allow login credentials to be stolen

#40

Post by sitkack »

lmohseni wrote: post #39
geoka9 wrote: post #38

Earlier quoted context omitted.

Don't forget wifi connectivity...

A web based admin interface might be handy as well...

Ohhh, with automatic firmware updates! Maybe it syncs over Bluetooth, or pretends to be a car infotainment system to keep a copy of your mobile contacts.

The complexity probably warrants some sort of embedded microservice arch, like microK8S.

Post reply on HN