3 ms·

I just re-read the thread and realise I completely missed the bit where auto-fill is sent when turned off. That definitely had to be a bug! In regards to the l

I just re-read the thread and realise I completely missed the bit where auto-fill is sent when turned off. That definitely had to be a bug! In regards to the last statement. It’s much rarer now-days for a sub domain site to be owned outright by someone else where they have logs or a deployed website to capture this information. In fact I honestly cannot think of a subdomain where I can upload my own code to. All the sub domains I can think of are just for multi tenant systems so you have to trust the root domain.

shakna 6y ago
Github Pages, Netlify, Surge. Wordpress hosts. All of these have very different people controlling the code on the subdomain, than on the root. The root in many cases may actually be trustworthy, but there's no reason to send them credentials that belong with the subdomain.
SturgeonsLaw 6y ago
Dynamic DNS hosts could have thousands of subdomains under an individual domain, can be registered for free, and those credentials could get an attacker right into people's home networks. An attacker could hide a bunch of iframes in a page and cover lots of bases in one go.