Hacker News Reader

No, the simplest (but far from the only) example is DNS injection.

My friend ended up having the URL to a fraudulent version of her online banking start getting auto-completed by her phone’s browser because they’d gotten her to click on some random SMS links a few times.

Website looked identical to the real one so they managed to easily get her one-time-codes. “For security purposes please enter the one-time-code we just sent you.”

No DNS injection. Just auto-complete and a reasonable URL and a convincing <title> in the HTML !

For some reason, getting rid of autocomplete suggestions is harder than getting rid of all other browser data combined. I really don't know why. I've been wishing to clear autocomplete orders of magnitude more often than to clear history or cookies.

Not just in the browser. I somehow have my work account’s UPN somehow in my Google account history somewhere. So randomly Android will try to auto complete as that instead of the email address I used daily on forms, etc.

Well, doing ebanking on phone browser sounds like a bad idea to start with. (artificial) limitations of those browsers are only some of the reasons.

You're far safer doing banking stuff on your phone than on a computer.

Reply on news.ycombinator.com