3 ms·

A bug that tricks the secure password management tool into revealing your Twitter password to a website that is not Twitter! That's a pretty major security vuln

by rietta 10y ago

A bug that tricks the secure password management tool into revealing your Twitter password to a website that is not Twitter! That's a pretty major security vulnerability due to a bug in URL parsing.

kmiroslav 10y ago
But the information is not sent to the server, it's simply pasted in the text field.
- tronje 10y ago
  Yes, but some JavaScript can detect that the text field has been filled, and then send the information back to the attacker's server. An (innocent) example of this is when you type something into Google's search field, and you already see suggestions, even though you haven't clicked anywhere or hit Enter yet.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]