4 ms·
That is one of the main reasons why I use Opera where password is filled only after I press special button.
by anonymfus 14y ago
That is one of the main reasons why I use Opera where password is filled only after I press special button.
- homakov 14y agoyou always have to press that button. btw, can you test on opera?
- StavrosK 14y agoYou also always have to type in your password. What's the difference?
- aw3c2 14y agoalt-enter works too
- laumars 14y agoIt doesn't work in Opera. Basically Opera doesn't auto-complete unless you click a specific button once the page loads. Then Opera will not only auto complete the password form, but submit it as well.
- hythloday 14y agoIsn't there a race condition, where the password is visible to malicious Javascript, before the submit navigates away from the filled-form page?
- deleted 14y ago[deleted]
- plorkyeran 14y agoYes, and I've actually used that to extract my own password that I've forgotten. Opera's implementation coincidentally stops this specific attack, but it's not in any way a security mechanism.
- anonymfus 14y agoI can, and I can ever test race condition, mentioned by hythloday. http://youtu.be/jsfEy32n_xI http://youtu.be/jsfEy32n_xI
- exterm 14y agoI agree. The demo doesn't read the password in opera because it is not filled in. Take that, chrome users.
- hippich 14y agoIt doesn't really matter. Once hacker was able to put his JS on your page, one way or another it will be possible to pull password from password field, auto-completed, or human-entered.
- Lagged2Death 14y agoI alos use Opera. I'd wondered why its password management was designed differently from the stuff in other browsers, and I guess this might be why. But the approach depends on the browser software to figure out which button on the page is the login button, rather than relying on the user to figure it out. I've run into one or two websites where Opera got that wrong, meaning the password manager couldn't work. Everything is a trade-off, I guess.