Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

81–90 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#81

Post by mackrevinack »

shrimp_emoji wrote: post #68
bakoo wrote: post #55

Earlier quoted context omitted.

Bitwarden has a hotkey to invoke autofill on a page. Not sure how much safer it actually is, but at least it feels like I'm in control.

It's safer as long as you don't hit it. (And, since the chance of you NOT hitting it is greater than zero, it can be called safer.) Hit it when logging in to HN. It will populate both the set of fields you've highlighted (login) as well as the other set on the page (register). If there were a third, hidden, injected set of fields controlled by an attacker, those would be filled too. The old security-convenience trade…

this wouldnt happen with keepass's auto-type which sends keystrokes from the desktop app. when you execute the hotkey with the focus on the username input, it types the username first, then sends the tab key, types the password, then sends enter. it wouldn't continue to fill in some hidden fields that are off screen.

i would have thought that most browser autofill extensions would be designed to only fill in details once, but who knows

Re: Autofill in password managers can allow login credentials to be stolen

#83

Post by enaaem »

yosito wrote: post #52
emodendroket wrote: post #9

Earlier quoted context omitted.

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

If you hide it in a random book, it will be unlikely found by anyone. Burglars don't steal books.

Re: Autofill in password managers can allow login credentials to be stolen

#84

Post by rudian »

I hate these articles. To steal the password you need malicious code running on the website. Autofill or not your data is taken.

The only action that needs to be taken by the browser or password manager is to specifically avoid autofilling multiple accounts. THAT is the problem here, not autofill itself.

Re: Autofill in password managers can allow login credentials to be stolen

#85

Post by mackrevinack »

Saris wrote: post #41
ishtanbul wrote: post #14

Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill

I wish it wasn't such a weird key combo though, it would be nice to do it with 1 hand.

i use keepassxc and have auto-type it set to alt+x which is very quick to execute with either hand. you can even just use your thumb to hit both keys at the same time!

Re: Autofill in password managers can allow login credentials to be stolen

#86

Post by ellen364 »

noduerme wrote: post #75
throwawayboise wrote: post #65

Earlier quoted context omitted.

A shared workstation should still be using separate user accounts, or an "anonymous" account that is completely reset (files, cache, browser history, etc.) between logins if there is some reason user accounts aren't possible.

the problem is that autofill fields persist regardless of login credentials to a particular site, as long as Chrome detects the input fields to be the same. Like, try a standard form behind a login process... then log out and log in as another user... chrome will suggest what the last user entered if you don't rename the input field.

Admittedly my first thought was “Turn off the browser’s auto fill.” On reflection, guessing that, although the work is all in-house, the software team has no influence over the setup of the client devices?

If the devices are all under company control, I suppose they could still turn off auto fill. But in a big company that’s a lot of devices and probably comes out of another department’s budget. Then the auto fill behaviour becomes the web app’s problem, despite being a browser behaviour.

Re: Autofill in password managers can allow login credentials to be stolen

#87

Post by valenterry »

kmonsen wrote: post #70
valenterry wrote: post #59

Earlier quoted context omitted.

What if the phone is fully compromised?

Is there any realistic scenario that protects against a fully compromised phone/computer?

I mean yeah, if you use 2FA and both phone and computer are just one factor on their own, then a compromised phone does not matter. So my question is, how about the mentioned scenario - to me it seems that just compromising the phone would compromise the whole, but maybe I misunderstood.

Re: Autofill in password managers can allow login credentials to be stolen

#89

Post by nazrulmum10 »

If login credentials are leaked on a site, it does not necessarily mean that an attacker has accessed the database. He could have just exploited an XSS or other client-side vulnerability and obtained login credentials from users who only followed the advice that they should use a password manager. So please, if recommending password managers, supply that users turn off autofill or be set to fill only upon user request by clicking in password manager's UI.

Re: Autofill in password managers can allow login credentials to be stolen

#90

Post by xiphias2 »

''After all, remembering dozens of unique passwords is almost impossible.''

It's not dosens but hundreds, and it is impossible if the passwords are secure. The article may have good information, but the advice of turning off autofill and going back to remembering passwords is terrible.

Post reply on HN