this post was submitted on 06 Sep 2023
300 points (99.0% liked)
Technology
58303 readers
9 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I’m not sure password managers like Last Pass or 1 Password could actually function without access to the DOM.
Most extensions won't work without access to the DOM, since most extension need to interact with the webpage displayed. I mean what's the point of being a browser extension if you can't interact with the web page. The suggestion is to alert when a password field is accessed, maybe an extra permission an extension needs to access the value of a password field. Most extensions don't need to, for example "dark reader" does not need to know any input field or text node value. So if it suddenly asked for permissions to read my password that would be very suspicious.
The problem then becomes that extensions are still in control of everything else on the website: A malicious extension could simply hide or move the input field away and then create a new one in its place.
Personally, I don't see how one could make extensions secure without severely crippling their functionality or turning it into a game of cat and mouse.
If an extension is blocked by the browser from accessing the value of any input field, text node content and recording keystrokes how can it then manipulate pages in a way that grants access to passwords?
The extension designer would have to actually create functionality which plausibly needs those permissions granted. Which would put a big dent in the "hello, if you want to monetize your extension put this code in it" type of scammers trying to gain access to that information via an extension that helps you zoom into images or whatever
Then they could recreate their own input field by recreating their own "totally-not-an-input-field" with a canvas element and a bit of JS. Or, if that also gets blocked, just straight up redirect the user to a phishing site by replacing the login button or some other means. Plenty of people probably wouldn't notice in time.
That's a whole lot of effort compared to how they are able to phish now, which is launder their code by paying some (perhaps unsuspecting) extension developer to include an external dependency in their well-established extension.
Such effort as you're describing would be harder to pull off, easier to spot and limit the victim pool significantly all at the same time.
The methods they described are very common hacking techniques once a site is compromised. They are not difficult nor more work than you'd expect, not out of the realm of normal work for a hacker with a site they can tweak.
They only require permission to write to the password field, they don't necessarily need to read passwords. Although it does change the work flow for some users.
Many password managers use a “save new” or “update” login credentials feature that watches for newly used passwords and asks if you’d like to save the credentials used.
That’s going to go away if you remove the read access. That said, maybe that’s not such a bad thing. Plenty of people will dislike losing that feature, however.
And it could work how it does on Android or similar where the browser has suggestions you can select to fill the field. Originally was for accessibility but it also works for password manger suggestions or any other sutofill. The extension would offer the suggestions to the browser and only the browser would read and actually do the input.
I’m actually game for that idea, it would also make the browser responsible for parsing the many formats of html people use for structuring their input fields.