4 ms·

I think the point is that using saved passwords means you don't have to catch the user when logging in, you can grab the password at any time. (Assuming an XSS

I think the point is that using saved passwords means you don't have to catch the user when logging in, you can grab the password at any time. (Assuming an XSS attack exists of course.)

kaolinite 14y ago
Same goes for session cookies and the 'good thing' about session cookies is that an XSS attack should work anywhere on the domain, rather than just the login page (assuming it's not a website with a login form on each page).
- homakov 14y ago
  michaelmior is completely right. You don't need xss on login page. You can have xss on any page and open an iframe/window with login and then steal via same origin
  - kaolinite 14y ago
    Ok, fair point, but even so - it's still not as much of a concern as other XSS and auto-complete vulnerabilities.
    - homakov 14y ago
      XSS is ok. CSRF is ok. Losing my real password is the worst thing to happen
- deleted 14y ago
  [deleted]