News for hackers. Stuff that matters.

A comment on Autofill in password managers can allow login credentials to be stolen. Parent comment

Re:Autofill in password managers can allow login credentials... by tmsbrg on Tuesday July 27, 2021 @04:26AM (#27969983)
They don't need your session cookie either. An attacker can just use XmlHttpRequest to perform any actions as you on the website, and read the web page results. E.g. go to your profile and steal all your personal data.

They can also set up a keylogger or fake login screen and wait for you to type or paste in your password yourself.

I've always thought HttpOnly cookie flag is overrated. Stealing the session cookie may be the easiest attack but it's hardly the only.

[ Parent | on HN ]
Re:Autofill in password managers can allow login credentials... by hklutryhgg on Tuesday July 27, 2021 @06:03AM (#27970620)
I'm pretty sure you can defend against this with javascript script hashes and restrictive CSR's, but yeah, they are quite involved to setup.
[ Parent | on HN ]