Gregory W Gardener

Born still life.

[Adrian Sanabria (@[email protected]) @sawaba]

@amymist @LaurentGoderre Same here. Which 3rd party one do you use?

[Adrian Sanabria (@[email protected]) @sawaba]

@LaurentGoderre Try it for yourself. Here's Princeton's demo page: https://t.co/6v5fcULho6

[Gregory W Gardener @GregoryWGarden1]

@LaurentGoderre @sawaba That password is good for one night then you have to change again.

[Gregory W Gardener @GregoryWGarden1]

@LaurentGoderre @sawaba That password is good for one night then you have to change again.

[Laurent Goderre @LaurentGoderre]

@sawaba Yes but even if the manager fills the password, there shouldn't be any way for a script to access the value of that created field.

[Adrian Sanabria (@[email protected]) @sawaba]

@LaurentGoderre The proper username/pass fields aren't being subverted at all. This wouldn't be happening on the login page.

On a different page on the same site, the 3rd party ad script creates fields that fool password managers into auto-filling.

[Laurent Goderre @LaurentGoderre]

@sawaba What I mean though is that a password manager should only fill a field of type password, no matter what the name or ID of the field is. Then the browser prevents the leak of the password in the field.

[Gregory W Gardener @GregoryWGarden1]

@sawaba @LaurentGoderre Your right I'm sorry to say.

[Gregory W Gardener @GregoryWGarden1]

@sawaba @LaurentGoderre Your right I'm sorry to say.

[Adrian Sanabria (@[email protected]) @sawaba]

@LaurentGoderre They create their own password field on a non-login page - it doesn't use the proper one. Some password managers don't differentiate, some actively defend against these types of attacks (e.g. non-visible login forms).

[Laurent Goderre @LaurentGoderre]

@sawaba I need to test this bit I would be extremely surprised if the browser would let a script read the value of a password field.

[Gregory W Gardener @GregoryWGarden1]

@sawaba Yes I heard about that last night.

[Gregory W Gardener @GregoryWGarden1]

@sawaba Yes I heard about that last night.

[Adrian Sanabria (@[email protected]) @sawaba]

TL;DR - Advertisers are creating invisible login forms to capture any data your password manager is willing to auto-fill.

They're allegedly after your usernames, but there's nothing stopping them from capturing your password as well.

1. Block ads
2. Don't allow auto-fill https://t.co/sn34Adcb7N

[Gregory W Gardener @GregoryWGarden1]

@DanielNuDay @TheBirdAndBoo @poteye2002 @pplunkett9 @FoxNews Brain dead.

[Gregory W Gardener @GregoryWGarden1]

@DanielNuDay @TheBirdAndBoo @poteye2002 @pplunkett9 @FoxNews Brain dead.

[Daniel CFP @DanielNuDay]

@TheBirdAndBoo @poteye2002 @pplunkett9 @FoxNews Lolololol and then we can say Merry Christmas everyday?????

[Gregory W Gardener @GregoryWGarden1]

@TheBirdAndBoo @poteye2002 @pplunkett9 @FoxNews YA wait two years when he will double the taxes that we had in 2017.

[Gregory W Gardener @GregoryWGarden1]

@TheBirdAndBoo @poteye2002 @pplunkett9 @FoxNews YA wait two years when he will double the taxes that we had in 2017.