News for hackers. Stuff that matters.

A comment on Autofill in password managers can allow login credentials to be stolen. Parent comment

Re:Autofill in password managers can allow login credentials... by rvz on Monday July 26, 2021 @09:43PM (#27967667)
Well it still recognises to autofill in the password on a different subdomain as shown in the PoC by default, which is not good at all.

To Downvoters: So in the PoC [0] with the default settings the author is completely wrong about their findings? even if you 'manually' autofill in the fields?

So you are saying that the password DOESN'T get extracted out of Bitwarden from a different subdomain than where the login data was stored on by default then?

[0] https://marektoth.com/blog/password-managers-autofill/

[ Parent | on HN ]
Re:Autofill in password managers can allow login credentials... by joshuaavalon on Monday July 26, 2021 @10:23PM (#27967931)
There is a setting in URL of the password called "Match Detection"[1]. You can change it to "Host" if don't want it to match subdomain.

[1]: https://bitwarden.com/help/article/uri-match-detection/#matc...

[ Parent | on HN ]
Re:Autofill in password managers can allow login credentials... by ViViDboarder on Wednesday July 28, 2021 @12:49AM (#27980346)
> by default

This is the point parent and the source article are making. Not whether or not it’s possible to be configured more securely.

[ Parent | on HN ]