4 ms·
There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it
by velox_io 7y ago
There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it isn't "type='password'" and it is revealed. This only takes a matter of seconds.
Chrome should remove the password if there is any attempt to change that form object.
This flaw has been there for years, it's actually handy if I'm not sure what the password is.
- Smithalicious 7y agoIs this really an issue? Presumably anyone with access to the browser can acces saved passwords anyways; the censoring only prevents onlookers from reading it.
- Avamander 7y agoActually on Windows at least Chrome asks for a password when trying to view all passwords. So it isn't _that_ easy.
- Someone1234 7y agoIf you can modify the type of the field, you can also read the field's value without changing the type (e.g. document.getElementById('password').value from the console). Even just using the address bar via javascript:{alert(document.getElementById('password').value);} As Raymond Chen and others call it: "the airtight hatchway problem."[0] Meaning you're sitting in a context where you can steal the password in infinite ways and complaining about the easiest one. But ultimately fixing that one way still leaves infinite remaining ways. You're in the superuser context for the webpage. If you can modify the password field's type you can literally do anything to that page. [0] https://stackoverflow.com/questions/2787853/arent-passwords-written-in-inputbox-vulnerable-through-a-stack-trace https://stackoverflow.com/questions/2787853/arent-passwords-...