53
Major password managers can leak logins in clickjacking attacks (www.bleepingcomputer.com)
submitted 1 year ago by to c/news@lemmy.linuxuserspace.show
23 comments fedilink hide all child comments

all 23 comments

sorted by: hot top controversial new old
[–] 13 points 1 year ago

1Password, Bitwarden, Enpass, iCloud Passwords, LastPass, and LogMeOnce

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 1 year ago

    Once again I am reminded why I always use an adblocker.

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 1 year ago (4 children)

    This is somewhat clever, but if you're phished into attempting to login on a malicious page, you've already lost

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 2 points 1 year ago (3 children)

    Per the article, the attack works by making you think you’re clicking CAPTCHAs and reduces the opacity of the auto login buttons you’re actually pressing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 year ago (2 children)

    Yes, I read the article.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 1 year ago (1 child)

    Then I guess your comment confused me because the attack doesn’t require the user to attempt to log in. Completing a CAPTCHA on a random page isn’t internet idiot behavior, it’s what we’ve been trained to expect is the norm.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 year ago

    I think I meant to reply to the user who was talking about KeePass. If you have brought the user to a malicious page, you can already just impersonate the login form and something like KeePass that doesn't offer to autofill passwords will be none the wiser (because the user initiates the paste / autotype)

    In the XSS case, I think this would be occurring on a page the user trusts but has been compromised by an external script (via an ad or other means). If it's at a domain the user has saved credentials for, odds are high it's a login page, but I think you're right that an attacker could probably add their own input field to provoke the password manager overlay, with an innocuous-looking fake captcha or cookie banner over it.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 7 points 1 year ago

    Any insight in attacks on the browser password managers themselves?

  • permalink
  • fedilink
  • source
    •
    [–] 7 points 1 year ago

    Wouldn’t the attack need to happen on a subdomain of the site they’re trying to steal credentials for? At least Bitwarden won’t suggest any credentials to autofill otherwise (haven’t tried the others)

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 1 year ago (1 child)

    So if I just use the desktop app and not the browser extension then I'm good?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 4 points 1 year ago

    This is why I tattoo all my passwords backwards on my asscrack

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 1 year ago (5 children)

    I'm an idiot using bw, do we have much confidence in any means of avoiding this yet or no?

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] [S] 9 points 1 year ago (2 children)

    The easy-ish way is to use the desktop app, but from the article:

    However, Bitwarden told BleepingComputer that the issues have been fixed in version 2025.8.0, rolling out this week.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 1 year ago (1 child)

    I have pretty unserious threat model, so hopefully bw team is trustworthy enough to believe in their upcoming fix.

    Many thanks Leo!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 year ago

    My understanding is that bitwarden is generally very well regarded by security knowledgable folks, with the most secure option being keepass synced manually, and seemingly bitwarden behind that (among popular choices)

    That is my impression as a fairly non-technical casual privacy/security pursuer anyway 🤷‍♂️ I'm also a Bitwarden user as it's a better balance of practicality and security for my needs and usecase

  • permalink
  • fedilink
  • source
  • parent
    • [–] 12 points 1 year ago (4 children)

    Once again Keepass proves to be the superior solution.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 8 points 1 year ago* (2 children)

    That's not at all what the article says.

    They tested 11 popular password managers, Keepass wasn't one of them.

    So if it wasn't even tested for attacks that nearly every other manager fails at least 1 aspect of, then you should assume it's not safe either.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • 3 comments in c/pulse_of_truth@infosec.pub view that post
    [+] 3 points 1 year ago (2 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •