Hacker Bits, August 2016

Figure 2: Error page from Al Rajhi bank
The premise of all of these
is that you delegate “remembering”
your password to the
password manager and instead
the only real memory required
(at least of the human variety) is
to remember the single master
password that gains you access
to all the other ones.
Again, the debates on the
pros and cons of this have been
had so go back to the aforementioned
blog post and read the
comments if you want to jump
on that bandwagon.
Once a password manager
has the credentials stored,
clearly at some point in time,
you’d want to get them back
into a login form and actually
use them to gain access to the
website in question.
Password managers like
1Password can make this profoundly
simple in that they have
the ability to auto-fill the login
form of the website in question.
For example, I was able to
successfully use it to attempt to
login to the Al Rajhi bank (see
figure 2).
As you can clearly see from
the red error message, the login
credentials were incorrect (I’m
guessing “johnsmith” may not
be that common of a name
amongst their customers).
But as you can also clearly
see from the request headers,
both the username “johnsmith”
and the password “joshsmith”
were successfully sent. In other
words, whilst non-standard
onpaste implementation may be
blocking the old CTRL-V, 1Password’s
ability to auto-fill the
form is not hindered.
However, clever tricks like
auto-fill don’t always work.
Sometimes the name of the form
field changes either due to the
site being revised or because of
a perceived value of rotating and
obfuscating the ID of the field.
Sometimes you want to use
the same credentials on multiple
domains of the same service,
and auto-fill only works against
the domain the pattern was
recorded on.
Sometimes you’re in iOS
and you really just want to use
Safari, so you copy from the
1Password app and paste into
the browser.
There are many, many valid
reasons why people would want
to paste passwords in order to
increase their security profile,
yet the perception of those
blocking this practice is that it
actually decreases security. Why?
Interesting you should ask…
hacker bits
21