News for hackers. Stuff that matters.

A comment on Chrome 56 will mark HTTP pages with password fields as non-secure. Parent comment

Re:Chrome 56 will mark HTTP pages with password fields as no... by geofft on Sunday January 22, 2017 @09:41PM (#13459295)
Because my passwords for google.com, gmail.com, youtube.com, and google.co.uk are exactly the same, and the browser has no way of knowing that that's okay.

(Google specifically has probably rerouted everything through google.com these days, but the general problem exists.)

[ Parent | on HN ]
Re:Chrome 56 will mark HTTP pages with password fields as no... by nickik on Monday January 23, 2017 @09:38PM (#13468365)
Its a real problem, in the new anti-phishing protocols (U2F/UAF) have some ideas.

The Web Origin Concept - https://tools.ietf.org/html/rfc6454

The also require the server to provide a list of Origins that are valid for the protocol, if the domain your logging into is not in the list, the challenge of the server will not be signed. Its called AppID in the protocol.

See: https://fidoalliance.org/download/

[ Parent | on HN ]
Re:Chrome 56 will mark HTTP pages with password fields as no... by austinsharp on Sunday January 22, 2017 @11:05PM (#13459681)
I have this exact problem with LastPass. One of my few pain points with it.
[ Parent | on HN ]
Re:Chrome 56 will mark HTTP pages with password fields as no... by tempestn on Sunday January 22, 2017 @11:13PM (#13459700)
You can define equivalent domains in LastPass to solve that.
[ Parent | on HN ]
Re:Chrome 56 will mark HTTP pages with password fields as no... by austinsharp on Friday January 27, 2017 @04:44PM (#13502965)
Yes!!! Thank you!!!
[ Parent | on HN ]