3 ms·
Yes, but that's the essence of the whole problem: there are ways to spoof what the current website is, causing your context-aware password manager to spit out d
by reilly3000 7y ago
Yes, but that's the essence of the whole problem: there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't. Diabling autofill pretty much eliminates the whole vector though, without breaking UX that hard.
- dsissitka 7y ago> there are ways to spoof what the current website is, causing your context-aware password manager to spit out data it shouldn't. Can you give an example?
- zarify 7y agoThere was this example from 2017. https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u... I seem to remember reading about similar stuff done elsewhere, but don't remember the details (or apparently a useful search term :P).
- kerng 7y agoIsn't the XSS example highlighted here a good example?