Slashdot Mirror
Browser Autofill Profiles Can Be Abused For Phishing Attacks (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer: Browser autofill profiles are a reliable phishing vector that allow attackers to collect information from users via hidden form fields, which the browser automatically fills with preset personal information and which the user unknowingly sends to the attacker when he submits a form... Finnish web developer Viljami Kuosmanen has published a demo on GitHub... A user looking at this page will only see a Name and Email input field, along with a Submit button. Unless the user looks at the page's source code, he won't know that the form also contains six more fields named Phone, Organization, Address, Postal Code, City, and Country. If the user has an autofill profile set up in his browser, if he decides to autofill the two visible fields, the six hidden fields will be filled in as well, since they're part of the same form, even if invisible to the user's eye.
Browsers that support autofill profiles are Google Chrome, Safari, and Opera. Browsers like Edge, Vivaldi, and Firefox don't support this feature, but Mozilla is currently working on a similar feature.
Browsers that support autofill profiles are Google Chrome, Safari, and Opera. Browsers like Edge, Vivaldi, and Firefox don't support this feature, but Mozilla is currently working on a similar feature.
"don't autofill hidden form fields". Kudos to the researcher, but hardly a topic worthy of lengthy discussion?
Surely just only auto-fill visible fields?
Come on, folks. It's obvious that browsers by now are the primary vulnerability our there (except perhaps the IOThingies, which are even worse).
A huge, complex piece of software, with several interpreters built in, ready to execute whatever they hoover up on the 'nets, with no clear business model (do they belong to the users or to the advertising industry? Most of the fat money flowing in the general browser's direction comes from... you guessed it; and these days money "means" ownership, alas) and with fuzzy borders...
What could possibly go wrong?
And no, not ranting at the heroes who try to get that running: they're heroes. But they're tilting at windmills.
I don't understand people who even save passwords, let alone full profiles of themselves.
Should be pretty easy to program this function properly.
How about, for example, making sure the filled in elements are 100% visible to the user?
HTML was supposed to define a page semantically (e.g. header 1). Letting it get crufted up with instructions on how to make it look pretty was a horrible idea (albeit one that came early on). A form should look like a form. No, I don't need whatever new hotness some designer invented with some colorscheme A/B tested to hell and back to try to trick me into clicking the desired button.
Your ad here. Ask me how!
"don't autofill hidden form fields". Kudos to the researcher, but hardly a topic worthy of lengthy discussion?
Hmm.
Wow, you're right! That was easy!
The browser should show a dialog listing all the information that it's going to fill in. OK or Cancel. Done.
The only responsible action for the browser companies to do is to kill off autofill. There's no reliable way for the browser to be sure the user can see which fields have been autofilled. Any attempt to popup and warn the user is going to be annoying, reduce the convenience of the feature, be confusing and people will just click-through 99% of the time anyway. This is why we can't have nice things.
Watch most comments (except a few snarky ones) fixing a touch of paint on a window sill here or on a bulging patch there: the whole house's frame is rotten and the roof is already leaning perilously.
As long as we can't answer the question properly "whose browser is it"? we are not at the meat of the matter.
Stakeholders, in rough order of involvement:
- advertising industry
- state actors, more or less shady
- "intellectual property" industry
- 499 more, not named here
- the user
Guess how much weight the user's interests have. Of course, for those stakeholders at the top, user's *trust* makes a difference (as long as there are different "brands" of browsers), but only perception really matters: a warm, fuzzy feeling that "you are being taken care of".
What really drives me crazy is the blindness of techies, insisting that "making sure the filled in elements are 100% visible to the user" or "just offer an (ignorable) popup in the corner" or "HTML should be display neutral" would fix anything. Best case it'd stuff that hole in the (totally rotten) front door threshold while the mud is rushing in through than gap left by the collapsed rear wall.
I don't autofill forms. Ever. Since I'll review the data in the fields anyway, I'll just type it myself or use the down arrow to get a historical entry all by itself. If it goes yellow and attempts to fill in a set of fields at once I skip it.
I am one user who uses autofill and would glance over such a thing to make sure I am sending what I think I am sending. Recently the autofill has been appending the day of my birth to my address. I even saw it append it twice! I would really welcome such a feature for reasons in addition to accidental overshare.
Well, Ideally you would have a different password for every site you log into. Some sites store the password or some way the current password can be recovered, so that if they get hacked or something the attacker will try it on other sites. You can try to remember them all, but I prefer to keep them in a password protected cache that I remember the password to and don't save.
The browser should place an "autofill" button on the toolbar or someplace off limits from any web site manipulation.
This button should open a dialog box listing all the fields to be filled with the data to be filled, with checkboxes to enable/disable filling certain fields and to edit the data that is submitted.
This would allow the user to be certain as to what form fields were filled and which ones weren't in a UI environment not controlled/manipulated by the web site.
Perhaps they could even extend it to create "profiles" of common field data that would allow you to choose from various sets of data (different addresses, phone numbers, etc) to fill in.
But they should make use of the browser-controlled autofill dialog mandatory and never fill web page fields unless the user interacted with the browser autofill dialog so that sites couldn't mine data through hidden fields or cause accidental autofills from taking place.
the fact5 and fuelinUg internal is dying.Things
I never use autofill and I turn it off whenever possible. It is the fear of exactly the same kind of shit that keeps me away from it.
Basically, if the browser knows about your identifying information, you should assume an attacker knows already.
Still stupid. I have seperate passwords for all the sites/devices I own. The trick to remembering them is to have a system - so if you forget it you can work out what the system is depending on the site. Don't do something stupid like have the website name as the password though, obviously...and I can't tell you my system because then it would be compromised. Have a think though, and I'm sure you could come up with something.
HTML was supposed to define a page semantically (e.g. header 1). Letting it get crufted up with instructions on how to make it look pretty was a horrible idea (albeit one that came early on). A form should look like a form. No, I don't need whatever new hotness some designer invented with some color scheme A/B tested to hell and back to try to trick me into clicking the desired button.
The solution to your problem is this great browser calld Lynx. Google it!
If you want news from today, you have to come back tomorrow.
The trick to remembering them is to have a system
On problem with systems is the wide variety of disallowed / allowed / required characters in passwords for various sites ("minimum of eight characters, at least one lower case, one uppper case, and one digit (but we won't accept puncuation marks and don't say that)"), in rulesets that are only displayed when you set the password, not when you enter it.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
In order to be affected you have to submit a form to a site. File this one under "you get what you deserve."
Is there some reason you can't be bothered to write down the ruleset if you think you wouldn't remember it?
File under 'M' for 'Manic ranting'
My typing isn't perfect and it would be frustrating attempting to type the password in over and over again for one.
Combine this with the fact that Chrome has been wanting as of late to autofill even CC numbers .... New vector for collecting CC numbers for fraudulent charges
Of all the items the hidden autofill can access, "phone" is a little annoying. But not that much. I can pretty easily now block calls and span texts.
It's not like it is auto-filling CC details for example. That is triggered separately from address data.
Are you worried someone is going to send you a catalog you did not ask for? Welcome to the party pal.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Dude, just get KeePass.
I can't be the only one who has disabled auto-fill from day 1 for precisely this reason, am I?
Security isn't hard if you think about it during the design stage and you're willing to scrap designs that are inherently insecure, such as automatically sending personal information to random web sites.
"Grab them by the pussy" -- President of the United States of America
Is there some reason you can't be bothered to write down the ruleset if you think you wouldn't remember it?
You're kidding, right? Writing down the rule set would be writing down ALL of my passwords, past, present, and future. B-b
But my point was that:
- The variability of "password quality" rules means the ruelset has to be complex enough to handle different cases for sites with different rulesets.
- The lack of display of the site's password quality rules at login means a password generation ruleset isn't enough. You still need to record something about the particular site to know which workaround branch of the ruleset to use with the site.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
How does writing down the ruleset that a site requires, which is information that you get when you first create the password, allow anyone to guess your passwords? This is information that anyone who was setting up a password on that site would already know anyways, or at least be able to trivially get. You would be no more compromising your own passwords with such information than you would be compromising everybody else's.
File under 'M' for 'Manic ranting'