JOjosephscott·May 6, 2021Submission
A simple demo of phishing by abusing the browser autofill feature
3 points · Open discussionanttiviljami
browser-autofill-phishing
JavaScript2017–2021
anttiviljami / browser-autofill-phishing
browser-autofill-phishing
A simple demo of phishing by abusing the browser autofill feature
3Distinct people
4Mentions
0Explicit recommenders
1.5KGitHub stars
What to know before exploring
What it is
A simple demo of phishing by abusing the browser autofill feature
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year4 dated mentions
Observed mentions: 2017-01-05 17:57:55 UTC to 2021-05-06 19:21:44 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
4 sourcesThey already have completed VR projects: https://vr.mozilla.org/
Pocket required essentially no work. They bought an existing service and stuck a fancy bookmark for it into Firefox.
And well, I'm mainly just repeating what Mozilla devs have said. They are deeper into the matter than both us, they can better judge just how much work it is. And it's easy to forget just how complex web browsers are. None of the major browsers use a browser engine which's development started in this millenium for exactly this reason.
I'm also not aware of Chrome being less explodable. I'd say, it's more explodable with its malware-filled extension store, default unencrypted sync service and annecdotally a vulnerability like this [1] being left unfixed for years and careless behaviour like this [2].
[1]: https://github.com/anttiviljami/browser-autofill-phishin
Read the rest
g
[2]: https://www.wired.com/story/chrome-yubikey-phishing-webusb/
Firefox used to have a worse security architecture, but it's essentially equivalent now. The only real difference that I'm aware of, is that Firefox by default groups processes for tabs, meaning if a webpage manages to exploit a major vulnerability in Firefox to gain control of the process it's being executed in, then it has access to 1/4 of your tabs and therefore might potentially be able to steal sensitive data, whereas in Chrome it would then also have to exploit a vulnerability in the OS to do that.
I can't imagine that there would be such a writeup. Even just trying to understand the security framework of one browser is a gargantuan task.
As for Chrome being a real issue, some points off the top of my head:
- Its extension store breeds out malware in regular intervals (feels like there's headlines about that at least every other month).
- Pretty bad autofill exploit that was left unfixed for years: https://github.com/anttiviljami/browser-autofill-phishing
(Might've been fixed in the past year, I haven't checked, but I doubt it.)
- Chrome Sync is not end-to-end-encrypted without the use of a second password, which effectively means that it is unencrypted for 99.9% of Chrome users. Google also actively uses this data, weaving your browsing history into the profile that they keep of you. So, if they ever have a data leak, a lot of data
Read the rest
is going to come from people using Chrome, too. The NSA/CIA/FBI also tap into this data, possibly using it for cyber war attacks, so if you live in a country other than the USA, you're making yourself a prime target and an easy target by inputting this data through Chrome.