News for hackers. Stuff that matters.

A comment on Browser auto-fill phishing. Parent comment

Re:Browser auto-fill phishing by Ajedi32 on Thursday January 05, 2017 @02:41PM (#13330616)
> Otherwise, a warning about what auto-fill information (IE "Your name and credit card information are going to be submitted, continue?")

FYI this doesn't work for credit card info, at least not in Chrome. That information has to be auto-filled separately.

[ Parent | on HN ]
Re:Browser auto-fill phishing by tyingq on Friday January 06, 2017 @11:41AM (#13337722)
It does "sort of" work on Chrome. It does give the end user a visual cue when typing in a name...the last 4 and the cc logo: http://i.imgur.com/2bY2Pes.png

But, if the end user doesn't notice or care about the visual cue, you can exploit it. Start typing in a name that has a credit card associated with it in Chrome's autofill: https://jsfiddle.net/hvs4ox2q/4/

[ Parent | on HN ]