4 ms·

If he thinks that is nefarious wait until he learns that websites were using visually hidden fields to surreptitiously capture browser auto-complete details. Th

If he thinks that is nefarious wait until he learns that websites were using visually hidden fields to surreptitiously capture browser auto-complete details. That is, if you auto complete "name" they might have an "email", "phone number", "address", etc. field hidden from your view that also get auto filled. I sure hope that browser makers have patched that somehow but I still avoid auto-complete whenever possible.

mfontani 6y ago
I _hate_ that browsers auto-complete hidden fields for a different reason: using a hidden "telephone" or "phone" field was a low-effort but quite reliable method to weed bots from users... as users wouldn't fill a hidden field - only bots would. Enter autocomplete completing hidden fields :/
Zhenya 6y ago
Is there a place where I can learn more about this? Clever and scary.
- thedirt0115 6y ago
  Demo + discussion: https://news.ycombinator.com/item?id=13329525 https://news.ycombinator.com/item?id=13329525
  - Zhenya 6y ago
    You rock. A genuine thank you and an upvote
neurostimulant 6y ago
Also, session replay is actually pretty common when the webmaster want to see how the visitors use their website. It basically capture everything including mouse movements, page scroll and form states.
afiori 6y ago
For this I absolutely hate firefox master password feature. Every once in a while you get prompted to insert your password without any kind of indication of why, which tabs prompted it, what domain is asking, or even whether it is just firefox periodic syncing.
- Zenbit_UX 6y ago
  Agreed, the worst is after you restart Firefox and have dozens of tabs from the same site open (like reddit or HN) and each one of them requests your master password over and over until you reject each tab's plea for you to authenticate or finally give into the software you're supposed to be in control of. If anyone at Mozilla is reading this, please fix this, it's incredibly obnoxious. I'd also appreciate it if you styled your master password prompt better than a javascript alert dialog so I know I'm typing in my most valuable password in the world into the browser and not some site pretending to be you.

mfontani 6y ago

I _hate_ that browsers auto-complete hidden fields for a different reason: using a hidden "telephone" or "phone" field was a low-effort but quite reliable method to weed bots from users... as users wouldn't fill a hidden field - only bots would. Enter autocomplete completing hidden fields :/

Zhenya 6y ago

Is there a place where I can learn more about this? Clever and scary.

thedirt0115 6y ago
Demo + discussion: https://news.ycombinator.com/item?id=13329525 https://news.ycombinator.com/item?id=13329525
- Zhenya 6y ago
  You rock. A genuine thank you and an upvote

neurostimulant 6y ago

Also, session replay is actually pretty common when the webmaster want to see how the visitors use their website. It basically capture everything including mouse movements, page scroll and form states.

afiori 6y ago

For this I absolutely hate firefox master password feature. Every once in a while you get prompted to insert your password without any kind of indication of why, which tabs prompted it, what domain is asking, or even whether it is just firefox periodic syncing.

Zenbit_UX 6y ago
Agreed, the worst is after you restart Firefox and have dozens of tabs from the same site open (like reddit or HN) and each one of them requests your master password over and over until you reject each tab's plea for you to authenticate or finally give into the software you're supposed to be in control of. If anyone at Mozilla is reading this, please fix this, it's incredibly obnoxious. I'd also appreciate it if you styled your master password prompt better than a javascript alert dialog so I know I'm typing in my most valuable password in the world into the browser and not some site pretending to be you.