The system for autofilling fields and forms in browsers has proven very convenient for users tired of writing the same thing over and over. But autocomplete can become a security risk if not implemented correctly. Developer Viljami Kuosmanen discovered that autocomplete profiles in Opera, Chrome and Safari publish their full content every time they are activated, and all an attacker needs is to create hidden fields on a webpage to extract the rest of the data.
Filling out forms is... tedious, yes. There's no point denying it. Some users do it daily, and frustration builds up. But autocomplete and text prediction features come to the rescue. First name, last name, birth date, physical address, email address, phone number... with a couple of clicks or a keyboard shortcut, all those fields get filled automatically. Without a doubt, autocomplete isn't going anywhere... but how secure is its implementation? After all, there is personal data in its profiles. According to Finnish developer Viljami Kuosmanen, autocomplete leaves a lot to be desired, and he created a simple page to demonstrate it.
The page has just two fields, name and email. The idea is that users of autocomplete systems in Opera, Safari and Chrome use their automatic profiles to fill in the data and press Submit. But what is shown next is data for which there were no fields in the first place. What happened? In essence, the page includes hidden fields that autocomplete profiles fill anyway, without the user knowing. This "trick" also works with some extensions that support autocomplete (such as LastPass).
The recommendation is to avoid the autocomplete system until developers of affected browsers introduce a solution to prevent profiles from filling hidden fields, or at least use it only on trusted portals. The only "immune" browser, so to speak, is Firefox, since it only supports field-by-field autocomplete (although the company confirmed a more elaborate autocomplete for future versions).
