Issue metadata
Sign in to add a comment
|
Security: You can easily steal someone's gmail passwords thru autofill and inspect element
Reported by
s...@mystyleplatform.com,
Feb 23 2018
|
||||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS You can inspect element on any gmail login password field, and easily see and recover the password that is supposed to be hidden by the dots/asterisks because you're writing it into an attribute called "data-initial-value" for some crazy reason. This makes it ridiculously easy to work around the obfuscation of the password characters and works around your security check to recover a saved password from the password manager. VERSION Version 63.0.3239.132 (Official Build) (64-bit) Operating System: Verified on both Win7 and Win10 and Mac OSx REPRODUCTION CASE Usually to recover what an autofill password is you have to go to Settings > Manage Passwords > Show Password, and it makes you authenticate thru the OS login popup. However, if you just click into a password field, and then it prompts you to autofill a password for any given account, and then just open the inspector tools and look, there's the saved password in plain text, easy to read, copy and paste, or take home and rob someone's life with. This is way, way too easily done. With this easy trick anyone can take someone's 10 most important logins complete with password while they're in the bathroom for 30 seconds. Or at least grab their gmail user and password in less than 5 seconds. That's far too easy to exploit. The browser can easily avoid / block this. NO OTHER WEBSITES write your password to the dom in plain text like that. That's beyond silly and careless to be exposing like that and negates your entire security step in saved passwords section.
,
Mar 22 2018
The following articles explain why browsers do not attempt to protect against what are called "physically local" attacks: https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#What-about-unmasking-of-passwords-with-the-developer-tools https://textslashplain.com/2017/10/16/stealing-your-own-password-is-not-a-vulnerability/ |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Feb 23 2018Mergedinto: 126398
Status: Duplicate (was: Unconfirmed)
Summary: Security: You can easily steal someone's gmail passwords thru autofill and inspect element (was: Security: You can easily steal someone's gmail passwords (probably all of their saved passwords) thru autofill and inspect element to see them in plain text far too easily.)