Web Trackers Exploit Flaw in Browser Login Managers to Steal Usernames (browser design flaw)

Discussion in 'Security News' started by LASER_oneXM, Dec 27, 2017.

  1. LASER_oneXM

    LASER_oneXM Level 18
    Content Creator

    Feb 4, 2016
    863
    4,471
    university/IT
    Germany / Poland
    Windows 8.1
    Kaspersky


     
    Danielx64 and harlan4096 like this.
  2. oneeye

    oneeye Level 3

    Jul 14, 2014
    140
    215
    building trades
    north america
    I'm a bit late on this issue, but the main research was done by this group who found the replay-script issue, and this is second in that series.
    No boundaries for user identities: Web trackers exploit browser login managers

    Now, I wonder if using a master password in Firefox would prevent this invisible form from autofill? Chrome wouldn't, because as soon as you tap a page, it automatically fills forms if info available. Any browsers using Webview on newer Android would do the same. Only Firefox has master password that I'm aware of.
     
  3. DeepWeb

    DeepWeb Level 9

    Jul 1, 2017
    442
    1,434
    Nurse
    On a journey
    Windows 10
    Emsisoft
    It's incredible how this is not illegal. How is this not illegal? It's downright stealing credentials.
     
  4. oneeye

    oneeye Level 3

    Jul 14, 2014
    140
    215
    building trades
    north america
    Absolutely it's Theft! And I'm not completely sure adblockers can keep up with all the garbage being slung at users these days. We definitely need some strong privacy laws to stop this shat soon!
     
    DeepWeb likes this.
  5. Danielx64

    Danielx64 Level 8

    Mar 24, 2017
    396
    1,695
    Australia
    Windows 10
    ESET
    The answer is to not use the password manager built into the browser
     
  6. oneeye

    oneeye Level 3

    Jul 14, 2014
    140
    215
    building trades
    north america
    Very true! I do have "Keepass 2 for Android", which has a built-in keyboard for autofill, avoiding the insecure clipboard. And since I'm mobile only, this open-source freeware is the perfect solution.
     
Loading...