Hacker News Reader

Comment by latchkey | Hacker News Reader

I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via embedded javascript) that you've filled into the field without even submitting it first. By making this a manual process, it at least gives you a fighting chance.

View on HN

It shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.

> I'd assume all of my data has already been compromised without logging in.

Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that.

Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.

> I've never seen or heard of a site that actually did that.

Protonmail maybe ;-)

That's actually a good example!

How would you know that the site's been hacked, and if you do, why would you visit it?

I recently was looking into the possibility of finding a local tax prep service for the mess that is my taxes from 2020. I stumbled upon a website that was highly rated on Google and looked completely professional, so naturally I let my guard down a bit while browsing it. Before I knew it one of their navigation links in this otherwise professional looking site redirected me to some malware spewing porn site that probably would have downloaded and installed itself on my machine if I was not using uBlock Origin and on Mac. It's super easy to get tricked these days even when you are security conscious 95 percent of the time, it only takes that one 5 percent chance to go wrong.

I don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.

The goal of a password manager is to use random password, one generated for each website, so that if one is leaked... Well, nothing more ! So having autofill is a good feature.

Sure and I use that feature... But, you aren't thinking like a hacker.

Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.

Reply on news.ycombinator.com