Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Autofill in password managers can allow login credentials to be stolen

marektoth.com

Post reply on HN
Print view View original

91–100 of 144 posts

Re: Autofill in password managers can allow login credentials to be stolen

#91

Post by hklutryhgg »

crazygringo wrote: post #50

I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient. If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways . If a site is vulnerable to XSS it's basically game over security-w…

> If some site has an XSS vulnerability, then they've already got access to my session cookies

Not true if the website uses HttpOnly session cookies as they should.

Re: Autofill in password managers can allow login credentials to be stolen

#92

Post by mukesh610 »

BeefWellington wrote: post #67
nhumrich wrote: post #17

Earlier quoted context omitted.

Except, if there is XSS, its usually in user submitted data, like a post. You wouldn't type in your password on a user post or alert box. And the login page is usually on a different page altogether, by itself.

This is kind of irrelevant since you can pretty easily override everything about the XSS payload to make it look like a legitimate login page for the site you're looking for. Depending on the nature of the site, it's possible it won't even stand out as odd even if it loads a login control at a non-"login" URL.

HTML5 History API allows for modifying the URL too.

If an attacker leverages an XSS they can exactly replicate the login page, URL and all, only limited by payload size and modern protections like CSP.

Re: Autofill in password managers can allow login credentials to be stolen

#93

Post by maccard »

mjthompson wrote: post #63
yosito wrote: post #52

Earlier quoted context omitted.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

> A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they d…

If someone has remotely compromised my home network how do I know they haven't just installed a keylogger, and are capturing the passwords that I type in via a sticky note?

I'm just a person on the internet, so my threat model may be different to yours, but my threat model is for the most part phishing, social engineering, data breaches, and the likes. The majority of these are fixed by password autofill (for the most part)

Re: Autofill in password managers can allow login credentials to be stolen

#94

Post by maccard »

dredmorbius wrote: post #78
ericd wrote: post #12

Earlier quoted context omitted.

Time to revive the rolodex...

That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within r…

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.

What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offload that to a third party that I trust.

[0] https://bitwarden.com/help/article/what-encryption-is-used/

Re: Autofill in password managers can allow login credentials to be stolen

#95

Post by usrusr »

mjthompson wrote: post #63
yosito wrote: post #52

Earlier quoted context omitted.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

> A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they d…

> It is probably a sophisticated cyberattacker looking for credentials

It is probably the script of a sophisticated cyberattacker leveraging some vulnerability for looking for credentials of thousands of people at once. Yes, the burglar is a total non-threat by comparison (unless they happen to be working for your very personal enemy intelligence agency)

Good security practice would add a memorized element to the stored passwords as an informal second factor. Are there password managers that have good support for that when auto-filling and updating?

Re: Autofill in password managers can allow login credentials to be stolen

#96

Post by tmsbrg »

hklutryhgg wrote: post #91
crazygringo wrote: post #50

I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient. If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways . If a site is vulnerable to XSS it's basically game over security-w…

> If some site has an XSS vulnerability, then they've already got access to my session cookies Not true if the website uses HttpOnly session cookies as they should.

They don't need your session cookie either. An attacker can just use XmlHttpRequest to perform any actions as you on the website, and read the web page results. E.g. go to your profile and steal all your personal data.

They can also set up a keylogger or fake login screen and wait for you to type or paste in your password yourself.

I've always thought HttpOnly cookie flag is overrated. Stealing the session cookie may be the easiest attack but it's hardly the only.

Re: Autofill in password managers can allow login credentials to be stolen

#98

Post by usrusr »

enaaem wrote: post #83
yosito wrote: post #52

Earlier quoted context omitted.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

If you hide it in a random book, it will be unlikely found by anyone. Burglars don't steal books.

When you hide it in a random book, and need to access it frequently, you end up with the plot device where the hyperintelligent detective guy immediately realizes that there can only be one reason this particular book looks more used than all the others.

The real threat of course is that you'll definitely not remember yourself (because you only use it for that one ring master password which you never use)

Re: Autofill in password managers can allow login credentials to be stolen

#99

Post by usrusr »

maccard wrote: post #94
dredmorbius wrote: post #78

Earlier quoted context omitted.

That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within r…

> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offl…

Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.

Re: Autofill in password managers can allow login credentials to be stolen

#100

Post by NavinF »

mjthompson wrote: post #63
yosito wrote: post #52

Earlier quoted context omitted.

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

> A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they d…

If someone sees a list of site/user/pass, wouldn't they take a photo of it instead of stealing the entire notebook? It just seems like the obvious thing to do.

>They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA

Did you get that from CSI: Miami? Nobody is gonna collect DNA samples just because some stuff went missing in your home. The cops will file a report and tell you to file an insurance claim.

Post reply on HN