News for hackers. Stuff that matters.
Re:A digital skeleton key to access any website by dogma1138 on Saturday May 09, 2015 @07:29PM (#9518076)
Well if it's a service then it isn't really different than most SSO providers out there. Yes it's technically different but the UX is virtually the same (and even easier with an SSO). You sign up once manually, then have to make several easy steps usually revolving just authorizing the 3rd party application to use your account.

Now i understand why many sites don't want to use SSO's, they lose control over their user base and get much less information from a registration via SSO than they would via their own registration form, and always the SSO providers (e.g. Twitter and LinkedIn) can always say you know what we don't want to provide that service any more, and in many cases you can be left with no ability to recover a large part of your user base.

That said I haven't seen many sites that Chrome cannot populate virtually their entire sign up page from memory, and like most stuff in Chrome it's also (can be) shared between devices as long as you are signed into one. Heck not that i would advise it but Chrome can even store your credit card number "securely" although that option i believe does not replicate between devices (never used it myself, not crazy:)).

Yes sign up processes can be annoying, especially when they obviously unnecessary, but from experiences the sites that put everything behind a signup wall rarely have much content to offer in the first place, since sites that actually want to monetize their user based tend to have very easy signups in order to reduce drop out rate. Heck just look at payday loaners, their sign up is as short as possible to get some info about you for a credit check and that's it, they don't want people to drop off before they get a loan and every step increases the chance that they'll figure out that taking one at 123514% APR isn't the best solution for their financial shortcomings.

Re:A digital skeleton key to access any website by tlrobinson on Saturday May 09, 2015 @10:49PM (#9518595)
"Heck not that i would advise it but Chrome can even store your credit card number "securely" although that option i believe does not replicate between devices (never used it myself, not crazy:))."

If my OS or Chrome is compromised I have bigger things to worry about than my credit card number, for which charges can easily be reversed...

Re:A digital skeleton key to access any website by dogma1138 on Saturday May 09, 2015 @11:13PM (#9518648)
Yes, but there's a compromise and a compromise, say there is a bug in Chrome that allows some one to exploit it in order to dump all of the auto-complete history including your CC but nothing else. Not everything results in a persistent exploitation of a system.

And even in such cases when the exploitation is persistent it's still a question of how much can they get and in what time window since you might detect it and remediate the situation.

I've seen some sneaky tactics that some sites used to get details from auto complete functions of browsers, yes chrome asks you if you want to submit that data, and asks you specifically for your CC but if you mask some fields such as address and phone number (Chrome detects if it's hidden, and to some extent when its not visible due to other factors so it needs to be just cleverly disguised in rendering) when some one just auto-fills say their email and username it might also leak personal information, and if people are not too careful also they're payment data (which i believe Chrome only auto-fills on sites you visited before, and on secure connections).

I personally only have to input my CC details online every couple of months since i use PayPal or Amazon Checkout for about 90-95% of my purchases, so i rather not have my CC data stored on my machine if i can avoid it. Yes if it's compromised they can eventually get it, but it's still better than it being stored in a place where every malware on the planet knows to look for it.