5

If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username first).

Can webpages check with JavaScript if the login fields are not empty (without submitting the form)?

I guess usually this would be possible, I saw that for live form validation. But maybe this auto-filled-in data follows other rules than user-filled-in data?

Improve this question
3
  • are you trying to disable automatic password entry?
    – BlackICE
    Commented Dec 20, 2012 at 19:43
  • Is there a "... and what next?" that makes this a IT security question rather than a Stack Overflow one?
    – bmike
    Commented Dec 20, 2012 at 19:51
  • 1
    @bmike, i guess it is obvious, that this can be abused, once the SOP was circumvented.
    – Hendrik Brummermann
    Commented Dec 20, 2012 at 21:36

2 Answers 2

Reset to default
4

Javascript can read password dialogs just like any other field:

document.getElementsByName("passwordentry")[0].value

so you can certainly have a piece of javascript that checks if the password field has been filled in much faster than humanly possible, as long as the user has javascript enabled..

You may want to implement a proof-of-concept to see how effective this is in practice and if there are any unforseen difficulties come up. edit A very important point by @Stephen Touset is that there are many different types of automatic password entry. It is important to be aware of them to detect them all.

Improve this answer
1
  • 1
    This technique wont work in some cases. Some browsers are configured to prompt you before filling in credentials, and some password managers (e.g., 1Password) require you to hit a hotkey before it fills them in. If you did want to catch those cases as well, you would need to poll the value of the password field repeatedly, every few milliseconds. If the password field went from empty to having its final value in one tick, it was probably filled in by this mechanism.
    – Stephen Touset
    Commented Dec 20, 2012 at 18:35
2

Yes it is possible for a webpage to retrieve the content of a password-field via JavaScript, just as most autofill-addons use JavaScript to insert the password based on the URL and the input-type or id of the password-field.

The following function prints all the passwords on the current page, if there is any, and could easily be modified to just check if a password-field has a certain minimum length.

(function () {
    var passwords, j, i;
    passwords = "";
    for (j = 0; j < document.forms.length; ++j) {
        for (i = 0; i < document.forms[j].length; ++i) {
            if (document.forms[j][i].type.toLowerCase() == "password") passwords += document.forms[j][i].value + "\n";
        }
    }
    if (passwords) alert("Passwords in forms on this page:\n\n" + passwords);
    else alert("There are no passwords in forms on this page.");
})();

Of course you might have this run with a little delay, in case the webpage is loaded faster than the autofill. But beware of not having a too high delay in case the user is a fast typist.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .