Beware of Browser Autofill and Password Managers - They Can Leak Your Personal Data

Advertisement
By Shekhar Thakran | Updated: 11 January 2017 19:12 IST
Highlights
  • Firefox is currently secure against this attack
  • Information for hidden boxes can be retrieved from autofill system
  • Chrome has the option switched on by default
Beware of Browser Autofill and Password Managers - They Can Leak Your Personal Data

We all like to use the autofill and built-in password manager features offered by Internet browsers as well as some third-party password managers in order to save time and avoid the trouble of remembering dozens of credentials. However, a new phishing attack might make you think twice before using the feature again. The phishing attack, discovered by a Finnish Web developer and hacker, tricks browsers as well as password managers into giving away users' credentials using a fairly simple trick.

Finnish Web developer and hacker Viljami Kuosmanen has found that Google's Chrome, Apple's Safari, as well as Opera, and password manager app LastPass, can all be tricked into leaking a user's personal information through their profile-based autofill systems, reports The Guardian. Kuosmanen discovered that whenever a user tries to fill up a form on the webpage, the autofill systems fill up the boxes even if they are not visible on the page.

 

This is why I don't like autofill in web forms. #phishing #security #infosec pic.twitter.com/mVIZD2RpJ3

— Viljami Kuosmanen ⭐ (@anttiviljami) January 4, 2017

 

This effectively means that while filling up the forms, the autofill system can potentially give away users' sensitive information if they confirm the autofill - even if only for a few visible fields. Chrome browser's autofill option is switched on by default and stores information such as email addresses, phone numbers, credit card information etc., as pointed out in the report.

Advertisement

Interestingly, Kuosmanen has also made a website to demonstrate how the process works. The webpage asks users to write their name and email address and has the boxes for mobile number and address hidden from plain site - the browser then proceeds to autofill this additional information without knowledge of the user.

Advertisement

As Firefox browser autofills each field individually, it is protected against this kind of an attack but the company is apparently working on a multi-field autofill system as well.

In order to ensure protection against such a phishing attack, users are advised to switch off the features from their browser

 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement
Popular Mobile Brands
  1. Vivo X200 FE Compact Smartphone Launched With 6,500mAh Battery
  2. Nothing Phone 3a Pro 5G Long Term Review: A Blend of Style, Speed, and Power
  3. AI+ Pulse, AI+ Nova 5G India Launch Timeline, Design and Colours Revealed
  4. Nothing Phone 3 Full Specifications Surface Ahead of Its July 1 Debut
  5. Tecno Spark Go 2 India Launch Date, Key Features Announced
  6. Oakley Meta Glasses With Meta AI Assistant Announced: See Features
  1. Samsung Exynos 2500 SoC With Up to 15 Percent Improved CPU Performance, Xclipse 950 GPU Launched
  2. Vivo X200 FE With 6,500mAh Battery, MediaTek Dimensity 9300+ SoC Launched: Specifications
  3. Tecno Spark Go 2 India Launch Date Set for June 24; Key Features, Colourways Teased
  4. Amazon Diagnostics Launched in India, Offers Doorstep Sample Collection in Six Cities
  5. Honor Magic V5 Teased to Measure 8.8mm Thick; Colours, RAM and Storage Details Revealed
  6. Apple Reportedly in Talks to Acquire Perplexity AI to Strengthen Its Artificial Intelligence Efforts
  7. Meta Discussed Buying Perplexity Before Investing in Scale
  8. AI+ Pulse, AI+ Nova 5G Confirmed to Launch in India in July; Design, Colour Options Revealed
  9. iPhone, iPad Pages Updated With Energy Labels to Comply With New EU Regulations
  10. Tesla Set to Open India Showrooms in July With Made-in-China EVs
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.