Browser auto-fill phishing

Re:Browser auto-fill phishing by FryHigh on Thursday January 05, 2017 @01:17PM (#13329703)

This vulnerability was published (another article) over a year ago. I'm surprised Chrome hasn't fixed it.

I think this means browsers will never fix this issue. I won't be using auto-fill on untrusted webaites.

[ Parent | on HN ]

Re:Browser auto-fill phishing by robert_tweed on Thursday January 05, 2017 @02:19PM (#13330420)

This is a very old exploit. The earliest references I could find were from 2010.

As other comments have noted, it isn't trivial to fix completely, so I believe most browsers just haven't bothered at all, but have implemented some extra protection for credit cards (and of course, CVV numbers are never stored in the first place).

[ Parent | on HN ]

Re:Browser auto-fill phishing by amenod on Thursday January 05, 2017 @02:57PM (#13330777)

Not all browsers - Firefox suggests form input values one by one (when you click in the field) so it is not vulnerable AFAICT.

[ Parent | on HN ]