Transcript
A tumblr post saying "i really like this thing where websites will have separate “log in” & “sign up” buttons and if you click “log in” it takes you to a sign-up screen anyway so you have to click “i already have an account” and then it will ask if you want to sign in with your facebook account or with instagram or linkedin or deviantart or whatever, and if you choose “username & password” it asks if you want to put in your username or use your thumbprint, and once you put your username & password it emails you a confirmation code, and once you put in the code it says “do you want to give us your phone number for future sign-ins? do you want to sign up for facial recognition? do you want to give us your bones? give us your fucking bones?”
Auto fill attacks is a weird way of saying password managers. You know. Those things that make it easier to use good password practices and be more secure.
I mean, there’s a reason browsers moved towards asking to autofill. Back when browsers would just do it automatically, there were malicious pages/ads that would hide fake username+password fields offscreen. So when the ad loaded, the browser would try to be helpful and would autofill the info. Then the ad would simply capture the autofilled info, and now your account is compromised.
Autofill attacks were so awful because the browser automatically did it without asking first. It was literally a zero-click drive-by attack that nabbed your info without any prompting or alerts on the user’s end. So to try and combat this, browsers moved towards requiring a prompt.
Tangentially, malicious ads then started using clipboard attacks instead. The ad would simply request your clipboard data, because there was a very good chance that it was your password. That’s why browsers stopped allowing sites to request clipboard data at all, and now it requires the user to actually push the data via a Ctrl+v instead; Anyone who has used Google Docs/Google Sheets will be able to tell you that Right Click>Paste doesn’t work, and it’s because the site isn’t allowed to request access to your system’s clipboard.
That’s all very interesting and insightful, but I don’t see how a site putting username and password entry on separate screens helps mitigate any of this, unless they’re doing something like showing ads on the page that asks for the username but not the one that asks for the password? I typically use ad blockers so I genuinely don’t know what’s standard. My gut feeling would but they don’t show ads on those pages at all. Apart from sites that have username and password boxes on the main page. But that’s still no reason to split the password from the username if both are on a dedicated page with no ads. I don’t see how it would prevent against fake password entry boxes either. Most of those sound like things the browser would ultimately need to mitigate against since any site could be compromised. Obviously sites have some role in it too.