However, in this case, a subdomain could still be hijacked by a hacker.īitwarden does issue a warning when you go to turn on its autofill feature, stating that "compromised or untrusted websites could take advantage of this to steal credentials."ĭespite the risk of iframe exploitation being announced (opens in new tab) in November 2018, Bitwarden decided to keep the autofill feature on login pages with iframes, since many popular websites do use them, "for example uses an iframe from ", Bitwarden told BleepingComputer (opens in new tab). Flashpoint says this is possible as "some content hosting providers allow hosting arbitrary content under a subdomain of their official domain, which also serves their login page".įree hosting sites allow for this kind of subdomain creation, but there are a lot of legitimate domains do not allow the registering of subdomains based on them. These subdomains can be used in phishing scams, where threat actors create fake pages using subdomains of legitimate website to steal your details. More of a concern, though, was that Bitwarden's autofill feature would even operate on subdomains of base domains for which you have a saved username and password for. However, Flashpoint found that the risk of such an attack was low as many legitimate and popular websites do not contain iframes on their login pages. > One of the best password managers around now offers an additional layer of protection (opens in new tab)
> Bitwarden vs 1Password: 2023 Features Comparison (opens in new tab) Another top password manager is doing away with passwords (opens in new tab)
0 kommentar(er)
