@craigmaloney fucking bastards

@craigmaloney the insidious part is that it’s just flying under the “well it came from the real domain and it’s https soooo it’s good!” permission model that browsers are all built with. This just isn’t true anymore with sites that are actively letting malicious entities run scripts under their name.

@craigmaloney wow. fucking disgusting.

i disabled autofill some time ago in anticipation of this sort of behavior. guess i'm not just paranoid. -.-

@craigmaloney oh no >:( time to turn off lastpass auto fill I guess

@craigmaloney This is why I use NoScript and block JS by default. Many sites work fine without JS (some work better!), and I can enable JS on a domain-by-domain basis as needed.

There are a billion ways advertisers can uniquely fingerprint your browser, and most of those techniques rely on JS. Things like font enumeration, history enumeration, this new password manager hack, etc.

Sadly, it's the only secure way to use the web now.

@craigmaloney Yay, #javascript.

Always having fun times when people tell me I'm paranoid for avoiding it…

@craigmaloney the fact that this is possible is a security issue tho

if they're doing it, the bad guys definitely are

@craigmaloney "For Narayanan, most of the blame goes to the websites who choose to run scripts like AdThink..."

Really? The blame is on the users? Not on the people who wrote the invasive software?

@craigmaloney

What I've noticed lately is that Firefox won't fill in the password until I click on something -- specifically, it shows my username in a drop-down, and only fills in the password if I select it.

But still... wow, that's a pretty major exploit. o.0

(...and what's to stop the javascript from "selecting" it for me?)

cc: @bstacey

@craigmaloney Never really trusted storing my passwords in the browser. I always associated that with high vulnerability, similar to not browsing in private mode on adult sites (sorry for the example), or not logging out of email at school. My thinking was that a password stored in the browser itself is the same as not having a password at all, since it’s accessible immediately.
But I kind of thought that I’d seem lay if said that