3 ms·
I think it would work against password managers like LastPass which fill in passwords using JS.
by akincisor 9y ago
I think it would work against password managers like LastPass which fill in passwords using JS.
- criswell 9y agoIt would only give you the last character of the password though. You can use CSS selectors to check the start [value^=a] and anything in the middle [value*=a] as well though which can be revealing I imagine.
- Klathmon 9y agoWell there's the start [value^=a], the end [value$=a] and the "anywhere" [value*=a] selectors. In something like 13000 selectors you could easily get the first 2, last 2, and any characters in the middle that are in the password making targeted attacks significantly easier. (This is based on very-very rough napkin math assuming an ~80 character dictionary for upper/lower, numbers, and "symbols" since I didn't want to count) That's a lot, but it's well within the realm of possibility (it looks like that would end up as about a 1mb css file)
- bzbarsky 9y agoNot if they do it correctly (by setting .value on the password field)!