Hacker News Reader

Comment by velox_io | Hacker News Reader

There's a major security flaw with auto-fill when it comes to passwords. Sure, it's hidden on screen, but you only have to change the password box's type, so it isn't "type='password'" and it is revealed. This only takes a matter of seconds.

Chrome should remove the password if there is any attempt to change that form object.

This flaw has been there for years, it's actually handy if I'm not sure what the password is.

View on HN

If you can modify the type of the field, you can also read the field's value without changing the type (e.g. document.getElementById('password').value from the console). Even just using the address bar via javascript:{alert(document.getElementById('password').value);}

As Raymond Chen and others call it: "the airtight hatchway problem."[0] Meaning you're sitting in a context where you can steal the password in infinite ways and complaining about the easiest one. But ultimately fixing that one way still leaves infinite remaining ways.

You're in the superuser context for the webpage. If you can modify the password field's type you can literally do anything to that page.

[0] https://stackoverflow.com/questions/2787853/arent-passwords-...

Is this really an issue? Presumably anyone with access to the browser can acces saved passwords anyways; the censoring only prevents onlookers from reading it.

Actually on Windows at least Chrome asks for a password when trying to view all passwords. So it isn't _that_ easy.

Reply on news.ycombinator.com