News for hackers. Stuff that matters.

A comment on Browser auto-fill phishing. Parent comment

Re:Browser auto-fill phishing by choward on Thursday January 05, 2017 @02:14PM (#13330382)
> If an element isn't drawn it shouldn't be autofilled.

So if a form is too long and you need to scroll, all those fields you can't see won't be auto-filled? Sounds pretty terrible IMO.

[ Parent | on HN ]
Re:Browser auto-fill phishing by chinathrow on Thursday January 05, 2017 @03:45PM (#13331228)
To me (as a non autofill user), the published bug sounds way more harmful than a little inconvenience.
[ Parent | on HN ]
Re:Browser auto-fill phishing by elsurudo on Thursday January 05, 2017 @05:00PM (#13331823)
It's not just an inconvenience – it's broken and unexpected UI behaviour.
[ Parent | on HN ]
Re:Browser auto-fill phishing by Jarwain on Thursday January 05, 2017 @09:48PM (#13333520)
Well why not have it autofill on-draw?
[ Parent | on HN ]
Re:Browser auto-fill phishing by onion2k on Friday January 06, 2017 @03:55AM (#13334833)
It'd be easy to move the hidden elements on to the screen when the user clicks the submit button, so they'd be filled in and the form would then be submitted, and the information 'phished'.

The solution to this problem is to inform the user which fields will be completed by autofill, with a "not currently shown" highlight on any fields that are currently off the screen so the user understands what's happening.

[ Parent | on HN ]