Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

71–80 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#71

Post by wbobeirne »

emodendroket wrote: post #11

Perhaps I'm slow. But if someone's discovered an XSS vulnerability for the site you're on, can't they just as well steal your password when you type it in?

Agreed, definitely not newsworthy. This is like pointing out that if you got access to arbitrary code execution on the HTTP server that accepts the login POST request, you could also steal login credentials. Or if you were running a malicious browser extension. Or the browser itself is compromised.

If an attacker is able to run any code they want anywhere along the way it's effectively game over, autofill or not.

Re: Autofill in password managers can allow login credentials to be stolen

#73

Post by Uberphallus »

crazygringo wrote: post #50

I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient. If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways . If a site is vulnerable to XSS it's basically game over security-w…

> If a site is vulnerable to XSS it's basically game over security-wise. Asking browsers and password managers not to autofill feels more like security theater at that point.

Exactly. It doesn't matter if the manager inputs it for you or you input it yourself. The only case where I see it strictly worse is in pages that require an extra password input while already logged in for modifying sensitive info/settings.

Re: Autofill in password managers can allow login credentials to be stolen

#74

Post by noduerme »

Marsymars wrote: post #66
noduerme wrote: post #53

Earlier quoted context omitted.

I mostly develop in-house business apps. So a prime example would be an application used at a shared corporate workstation. It's also not just about preventing credentials from leaking -- literally any form that is used by multiple users several times a day will start to accrete autofills, and that needs to be prevented. By the way, are you under the impression that most internet cafes scrub the browser autofill data…

I find it surprising that there are corporations that are using shared workstations in that way. My company has shared workstations, but you need to log in with your own account, as has been the case for every one of my previous employers. Modern operating systems and browsers seem like they’d have all kinds of pain points if they’re used by multiple users.

Yes. Imagine the front desk of a retail store, where each employee on their shift logs in, uses the software, and then logs out at the end of their shift. You don't want autofill to build up memory of customers or anything over their login period.

Re: Autofill in password managers can allow login credentials to be stolen

#75

Post by noduerme »

throwawayboise wrote: post #65
noduerme wrote: post #53

Earlier quoted context omitted.

I mostly develop in-house business apps. So a prime example would be an application used at a shared corporate workstation. It's also not just about preventing credentials from leaking -- literally any form that is used by multiple users several times a day will start to accrete autofills, and that needs to be prevented. By the way, are you under the impression that most internet cafes scrub the browser autofill data…

A shared workstation should still be using separate user accounts, or an "anonymous" account that is completely reset (files, cache, browser history, etc.) between logins if there is some reason user accounts aren't possible.

the problem is that autofill fields persist regardless of login credentials to a particular site, as long as Chrome detects the input fields to be the same. Like, try a standard form behind a login process... then log out and log in as another user... chrome will suggest what the last user entered if you don't rename the input field.

Re: Autofill in password managers can allow login credentials to be stolen

#76

Post by PhantomGremlin »

throwawayboise wrote: post #62
PhantomGremlin wrote: post #47

Earlier quoted context omitted.

A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tra…

Do you have your password manager database and private keys backed up in a way that would survive if you have a fire? A lot of people may think they have backups of stuff like this but unless you remember to grab that thumb drive out of your desk drawer (assuming you're home) a fire might still destroy them.

No, no, I don't have my passwords anywhere but in a paper notebook. And I don't have any other copies. That's what I meant by "my reckless behavior".

What percentage of people use a password manager? I think on iOS/macOS it's pretty high because Safari offers to save them, but what about non-technical users in general?

As to why I don't use a password manager, I think that the probability of some bug or hack or whatever of the password manager, which would lead to all my passwords being compromised, is greater than the probability of my house burning down.

Do I really want to trust Firefox with all my passwords? Do I really want to trust Google with all my passwords? (Fuck no!) Do I really want to trust some random password manager with all my passwords?

The smart thing to do, which I unfortunately don't, is to memorize a handful of passwords and use a password manager for the rest. E.g. remember bank password, use a password manager for Chipotle and Five Guys.

Re: Autofill in password managers can allow login credentials to be stolen

#77

Post by fomine3 »

Saris wrote: post #41
ishtanbul wrote: post #14

Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill

I wish it wasn't such a weird key combo though, it would be nice to do it with 1 hand.

I tend to forget that Shift and Ctrl is placed also on right side. (unless the keyboard is < 65%)

Re: Autofill in password managers can allow login credentials to be stolen

#78

Post by dredmorbius »

ericd wrote: post #12
emodendroket wrote: post #9

Earlier quoted context omitted.

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

Time to revive the rolodex...

That was going to be my suggestion.

I'm a fan of Zettlekasten for notetaking and knowledge management.

Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure.

The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within reason.

Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.

Re: Autofill in password managers can allow login credentials to be stolen

#79

Post by kaba0 »

shrimp_emoji wrote: post #68
bakoo wrote: post #55

Earlier quoted context omitted.

Bitwarden has a hotkey to invoke autofill on a page. Not sure how much safer it actually is, but at least it feels like I'm in control.

It's safer as long as you don't hit it. (And, since the chance of you NOT hitting it is greater than zero, it can be called safer.) Hit it when logging in to HN. It will populate both the set of fields you've highlighted (login) as well as the other set on the page (register). If there were a third, hidden, injected set of fields controlled by an attacker, those would be filled too. The old security-convenience trade…

If an attacker could inject anything into the page, they may as well rewrite the form’s target URL, so I don’t see a real threat model for that.

Re: Autofill in password managers can allow login credentials to be stolen

#80

Post by numpad0 »

yosito wrote: post #52
emodendroket wrote: post #9

Earlier quoted context omitted.

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

There’s an assumption that no malicious actors exist in any physical proximity. A strange thing to say but so far probably true enough.
Post reply on HN