Wait, what? How does autofill get fooled?
Comment on Password manager by Amazon
MentalEdge@sopuli.xyz 3 weeks agoExcept they can be fooled too.
Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.
Serinus@lemmy.world 3 weeks ago
gaylord_fartmaster@lemmy.world 3 weeks ago
Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it’s typed. They don’t even have to be visible to the user and bitwarden will fill them in as soon as the page loads.
Serinus@lemmy.world 3 weeks ago
Bitwarden will only autofill if the domain matches.
gaylord_fartmaster@lemmy.world 3 weeks ago
Right, “maliciously sneak”, as in they’ve either gained access to make changes to the site ditectly, or they’ve found a way to inject their scripts to steal creds.
lmmarsano@lemmynsfw.com 3 weeks ago
they can be fooled too.
Makes it harder: when I go to the wrong website, the manager simply doesn’t suggest credentials (it does not have) for it. That causes me to wonder why.
Without a password manager, a user is never prompted to wonder. They’d simply not notice.
Darkassassin07@lemmy.ca 3 weeks ago
You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.