6

Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a warning about an invalid SSL certificate, in this case because of a slightly different domain name on the certificate (e.g. stack-exchange.com if I had been visiting stackexchange.com, without knowledge of whether one is an alias of the other).

I notified the website administrator via another route and do not intend to log in (or fill in any other details) until the certificate problem is resolved. However, after seeing the warning on the SSL certificate, I clicked through to see whether the site appears to be the same.

The page looked normal and Chrome's autofill feature automatically filled in my username and obscured password.

If the site had been intercepted/replaced by a malicious party, would that party be able to gather login information from autofill without the user clicking to login?

Improve this question
1
  • 1
    Yes, there are Session Replay techniques for that. See freedom-to-tinker.com/2017/11/15/… there has been recently some findings in this regard also websites using third-party tracking.
    – bonanza
    Commented Dec 21, 2017 at 10:21

1 Answer 1

Reset to default
1

This behavior will likely vary by browser.

With regards to Chrome I believe (at least for passwords) these values are displayed as entered but are not initially available to Javascript provided by the site. The moment you interact with the page (like clicking anywhere inside of it) it is.

I believe for IE / Firefox (as of late last year) the values were made available immediately so would suffer the issue you stated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .