News for hackers. Stuff that matters.
Re:LastPass autofill exploit by viraptor on Wednesday July 27, 2016 @06:03AM (#12171617)
This is just a PoC. Now imagine that the author instead:

1. Writes up that post.

2. Inserts an iframe in the post, which enumerates known sites. (hidden out of view with css tricks)

3. Instead of alerting on screen, sends the results back to their server.

4. Submits to HN.

Re:LastPass autofill exploit by maehwasu on Wednesday July 27, 2016 @07:13AM (#12171870)
It's also REALLY easy to deliver that malicious site through web ads, especially background pops.