Hacker News Reader

Seems like a clickjacking attack. Presumably you can use this to reveal passwords for other sites, depending on how the ui is coded.

View on HN

Sure, but where do the clicks actually end up?

The ui of the password manager, as demonstrated in the demo.

What parts of the UI of the password manager? What do the clicks actually do? The demo doesn't show that; it just shows the mouse being followed by a "(i)". So what? What does clicking "(i)" do?

it would have the password manager insert the password into some element on the page, and then probably send that password off to some site for exfill, but it wouldn't show you it's doing any of this

the image attached to this issues actually shows an example, using an alert to show you the JS had access to your PW https://bugs.chromium.org/p/project-zero/issues/detail?id=14...

Reply on news.ycombinator.com