Beware of Browser Autofill and Managers - They Can Leak Your Personal Data 5z6w21

We all like to use the autofill and built-in manager features offered by Internet browsers as well as some third-party managers in order to save time and avoid the trouble of ing dozens of credentials. However, a new phishing attack might make you think twice before using the feature again. The phishing attack, discovered by a Finnish Web developer and hacker, tricks browsers as well as managers into giving away s' credentials using a fairly simple trick. 5c4629

Finnish Web developer and hacker Viljami Kuosmanen has found that Google's Opera, and manager app Last, can all be tricked into leaking a 's personal information through their profile-based autofill systems, reports The Guardian. Kuosmanen discovered that whenever a tries to fill up a form on the webpage, the autofill systems fill up the boxes even if they are not visible on the page.

 

This is why I don't like autofill in web forms. #phishing #security #infosec pic.twitter.com/mVIZD2RpJ3

— Viljami Kuosmanen ⭐ (@anttiviljami) January 4, 2017

 

This effectively means that while filling up the forms, the autofill system can potentially give away s' sensitive information if they confirm the autofill - even if only for a few visible fields. Chrome browser's autofill option is switched on by default and stores information such as email addresses, phone numbers, credit card information etc., as pointed out in the report.

Interestingly, Kuosmanen has also made a website to demonstrate how the process works. The webpage asks s to write their name and email address and has the boxes for mobile number and address hidden from plain site - the browser then proceeds to autofill this additional information without knowledge of the .

As Firefox browser autofills each field individually, it is protected against this kind of an attack but the company is apparently working on a multi-field autofill system as well.

In order to ensure protection against such a phishing attack, s are advised to switch off the features from their browser