Password Autocomplete in Browser

Almost all browsers have the functionality that allows user to save username, password and other credentials that are entered into HTML forms. These credentials are saved in the local computer or in a cloud account provided by the browser. When a new credentials are entered in a form, the browser prompts if credentials should be saved. Thereafter when the same form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

Example

The following is the example of this vulnerability:-

        <INPUT TYPE="password" AUTOCOMPLETE="on">

    

Impact

The impact include:-

• Attacker getting access to user credentials.
• Possible loss of sensitive information.
• Manipulation of sensitive information.

Mitigation / Precaution

This vulnerability can be fixed by:-

• Disabling the password auto complete

        <INPUT TYPE="password" AUTOCOMPLETE="off">

    

Written by

Manieendar Mohan

Cyber Security Lead Engineer