Hacker News Reader

Comment by anonymfus | Hacker News Reader

That is one of the main reasons why I use Opera where password is filled only after I press special button.

It doesn't really matter. Once hacker was able to put his JS on your page, one way or another it will be possible to pull password from password field, auto-completed, or human-entered.

I alos use Opera. I'd wondered why its password management was designed differently from the stuff in other browsers, and I guess this might be why.

But the approach depends on the browser software to figure out which button on the page is the login button, rather than relying on the user to figure it out. I've run into one or two websites where Opera got that wrong, meaning the password manager couldn't work.

Everything is a trade-off, I guess.

I agree. The demo doesn't read the password in opera because it is not filled in. Take that, chrome users.

you always have to press that button. btw, can you test on opera?

You also always have to type in your password. What's the difference?

No, you don't.

I don't know about you, but I can't log in without a password.

Yes, you enter it once and let Opera remember it. After that, you don't have to type it in anymore, but you can use alt-enter.

homakov meant that the vulnerability still exists, and I was saying that it's better in Opera than in any other alternative.

alt-enter works too

It doesn't work in Opera.

Basically Opera doesn't auto-complete unless you click a specific button once the page loads. Then Opera will not only auto complete the password form, but submit it as well.

Isn't there a race condition, where the password is visible to malicious Javascript, before the submit navigates away from the filled-form page?

Yes, and I've actually used that to extract my own password that I've forgotten. Opera's implementation coincidentally stops this specific attack, but it's not in any way a security mechanism.

I can, and I can ever test race condition, mentioned by hythloday.

http://youtu.be/jsfEy32n_xI

Reply on news.ycombinator.com