3 ms·

I don't understand the Nordpass demo. What would double-clicking actually do?

• gruez 5y ago
  Seems like a clickjacking attack. Presumably you can use this to reveal passwords for other sites, depending on how the ui is coded.
  • raldi 5y ago
    Sure, but where do the clicks actually end up?
    • gruez 5y ago
      The ui of the password manager, as demonstrated in the demo.
      • raldi 5y ago
        What parts of the UI of the password manager? What do the clicks actually do? The demo doesn't show that; it just shows the mouse being followed by a "(i)". So what? What does clicking "(i)" do?
        • throwaway192874 5y ago
          it would have the password manager insert the password into some element on the page, and then probably send that password off to some site for exfill, but it wouldn't show you it's doing any of this the image attached to this issues actually shows an example, using an alert to show you the JS had access to your PW https://bugs.chromium.org/p/project-zero/issues/detail?id=1481 https://bugs.chromium.org/p/project-zero/issues/detail?id=14...