Autofill in password managers can allow login credentials to be stolen

Re:Autofill in password managers can allow login credentials... by inyourtenement on Tuesday July 27, 2021 @09:30AM (#27972165)

Your first point doesn't really seem valid when comparing manual to automatic autofill. When I manually autofill, my password manager will show a suggested list of matching passwords. off1ce.com would not suggest my Office password, so I would still be alerted to a phishing site.

[ Parent | on HN ]

Re:Autofill in password managers can allow login credentials... by dbriles on Tuesday July 27, 2021 @11:56AM (#27973929)

I'm not sure I follow - automatic autofill and manual autofill would both raise red flags by not automatically filling in credentials (automatic autofill) or not suggesting credentials (manual autofill).

edit: I think I understand. My first point doesn't show that automatic autofill is better than manual, because both methods will raise red flags. I.e. this isn't a reason to choose automatic over manual autofill. I think this is a fair point.

I do think that both autofill methods have an advantage over simple copy/paste, especially given the XSS discussion in other threads here.

[ Parent | on HN ]