▲ 53 ▼ Major password managers can leak logins in clickjacking attacks (www.bleepingcomputer.com) submitted 1 year ago by leo@lemmy.linuxuserspace.show to c/news@lemmy.linuxuserspace.show 23 comments fedilink hide all child comments
[–] subignition@fedia.io 2 points 1 year ago (2 children) Yes, I read the article. permalink fedilink source parent hideshow 2 child comments replies: [–] Catoblepas@piefed.blahaj.zone 6 points 1 year ago (1 child) Then I guess your comment confused me because the attack doesn’t require the user to attempt to log in. Completing a CAPTCHA on a random page isn’t internet idiot behavior, it’s what we’ve been trained to expect is the norm. permalink fedilink source parent hideshow 1 child comment replies: [–] subignition@fedia.io 4 points 1 year ago I think I meant to reply to the user who was talking about KeePass. If you have brought the user to a malicious page, you can already just impersonate the login form and something like KeePass that doesn't offer to autofill passwords will be none the wiser (because the user initiates the paste / autotype) In the XSS case, I think this would be occurring on a page the user trusts but has been compromised by an external script (via an ad or other means). If it's at a domain the user has saved credentials for, odds are high it's a login page, but I think you're right that an attacker could probably add their own input field to provoke the password manager overlay, with an innocuous-looking fake captcha or cookie banner over it. permalink fedilink source parent
[–] Catoblepas@piefed.blahaj.zone 6 points 1 year ago (1 child) Then I guess your comment confused me because the attack doesn’t require the user to attempt to log in. Completing a CAPTCHA on a random page isn’t internet idiot behavior, it’s what we’ve been trained to expect is the norm. permalink fedilink source parent hideshow 1 child comment replies: [–] subignition@fedia.io 4 points 1 year ago I think I meant to reply to the user who was talking about KeePass. If you have brought the user to a malicious page, you can already just impersonate the login form and something like KeePass that doesn't offer to autofill passwords will be none the wiser (because the user initiates the paste / autotype) In the XSS case, I think this would be occurring on a page the user trusts but has been compromised by an external script (via an ad or other means). If it's at a domain the user has saved credentials for, odds are high it's a login page, but I think you're right that an attacker could probably add their own input field to provoke the password manager overlay, with an innocuous-looking fake captcha or cookie banner over it. permalink fedilink source parent
[–] subignition@fedia.io 4 points 1 year ago I think I meant to reply to the user who was talking about KeePass. If you have brought the user to a malicious page, you can already just impersonate the login form and something like KeePass that doesn't offer to autofill passwords will be none the wiser (because the user initiates the paste / autotype) In the XSS case, I think this would be occurring on a page the user trusts but has been compromised by an external script (via an ad or other means). If it's at a domain the user has saved credentials for, odds are high it's a login page, but I think you're right that an attacker could probably add their own input field to provoke the password manager overlay, with an innocuous-looking fake captcha or cookie banner over it. permalink fedilink source parent