6

Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a warning about an invalid SSL certificate, in this case because of a slightly different domain name on the certificate (e.g. stack-exchange.com if I had been visiting stackexchange.com, without knowledge of whether one is an alias of the other).

I notified the website administrator via another route and do not intend to log in (or fill in any other details) until the certificate problem is resolved. However, after seeing the warning on the SSL certificate, I clicked through to see whether the site appears to be the same.

The page looked normal and Chrome's autofill feature automatically filled in my username and obscured password.

If the site had been intercepted/replaced by a malicious party, would that party be able to gather login information from autofill without the user clicking to login?

  • 1
    Yes, there are Session Replay techniques for that. See freedom-to-tinker.com/2017/11/15/… there has been recently some findings in this regard also websites using third-party tracking. – bonanza Dec 21 '17 at 10:21
1

This behavior will likely vary by browser.

With regards to Chrome I believe (at least for passwords) these values are displayed as entered but are not initially available to Javascript provided by the site. The moment you interact with the page (like clicking anywhere inside of it) it is.

I believe for IE / Firefox (as of late last year) the values were made available immediately so would suffer the issue you stated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.