Password Autocomplete in Browser

Almost all browsers have the functionality that allows user to save username, password and other credentials that are entered into HTML forms. These credentials are saved in the local computer or in a cloud account provided by the browser. When a new credentials are entered in a form, the browser prompts if credentials should be saved. Thereafter when the same form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

Example

The following is the example of this vulnerability:-

        <INPUT TYPE="password" AUTOCOMPLETE="on">

    

Impact

The impact include:-

• Attacker getting access to user credentials.
• Possible loss of sensitive information.
• Manipulation of sensitive information.

Mitigation / Precaution

This vulnerability can be fixed by:-

• Disabling the password auto complete

        <INPUT TYPE="password" AUTOCOMPLETE="off">

    

Written by

Manindar Mohan

Cyber Security Lead Engineer

Manieendar is a dedicated Security Engineer with a wealth of experience in the cybersecurity landscape. He plays a pivotal role at Beagle Security, where he employs his extensive knowledge to safeguard systems against cyber threats. Manieendar's passion for cybersecurity extends beyond his professional role; he actively contributes to the online security community through insightful articles and speaking engagements.