Password autofill is not a new feature, yet its adoption has been slower than one might expect. Warnings about potential password leaks have made many of us reluctant to embrace this time-saving feature.
However, these warnings offer a partial picture. They focus on the risks, overlooking the undeniable convenience of autofill and the steps we can take to use it safely.
This article will give you the full picture of both the advantages and the risks associated with password autofill, offering practical advice on how to use this feature wisely.
The Dangers of Password Autofill
One common issue with password autofill arises from the fact that certain browsers and password managers autofill login forms even without the user’s permission. It’s an automatic process, leading to seamless login experiences.
Still, this convenience can be a boon to malicious actors.
They can employ a technique involving ‘iframes’ to insert elements of an authentic webpage into their own counterfeit sites. Unaware of this deceit, the password manager or browser views the login form as legitimate and provides it with the stored credentials.
This trick creates a potential pitfall for users. By disguising a nefarious site as a legitimate one, attackers cleverly coax autofill into revealing login credentials.
The site then uses scripts to capture these details as soon as they’re populated. It’s a silent theft; everything appears normal on the surface, while the credentials get quietly siphoned off.
It’s an effective form of credential stealing when users can get lured to fraudulent sites through clever social engineering tactics. They might click a fake link sent to their inbox, allowing the autofill feature to do the work for the attackers.
A notable example is Bitwarden, which recently came under scrutiny for its autofill feature’s security risks.
In March 2023, the security firm Flashpoint published a report highlighting how malicious websites could abuse it to steal login credentials when users visited them. In response to Flashpoint’s report, Bitwarden has since updated its autofill functionality to avoid filling in untrusted login forms.
To make matters worse, it’s not just usernames and passwords at stake.
Many password managers also offer to store sensitive data like credit card information and autofill it on shopping sites, for example. With a simple scam, an attack can collect numerous cards and charge them before their owners notice.
How to Avoid Vulnerabilities of The Autofill Feature
Choose Well-Designed Password Managers
Password managers offer an excellent solution for managing multiple complex passwords. Yet, not all are created equal when it comes to the autofill feature.
For instance, some solutions don’t preemptively fill out forms. Instead, they detect when stored credentials could be relevant and prompt users to fill in these details.
Only after user approval do those password managers auto-populate the information. This extra layer of security allows users to scrutinize the site or app they’re using and prevents any unintentional data giveaway.
Consider Disabling Automatic Filling
If the convenience doesn’t outweigh the risks for you, or if your browser or password manager fills out forms preemptively, you may want to disable autofill. This action puts you back in control of your data and reduces the chance of falling prey to a cleverly disguised phishing site.
To do this, follow instructions on Apple’s help page for how to change autofill on iPhone or for Android or Chrome users, go to Google autofill settings.
Use Multi-Factor Authentication
Multi-factor authentication (MFA) is a key player in the cybersecurity world and for a good reason. It adds an extra layer of security that makes life much harder for attackers.
With MFA enabled, even if someone manages to snatch your password via an autofill vulnerability, they still can’t access your account without the second factor. It’s like having a second lock on your front door – an additional barrier that thwarts would-be intruders.
Keep Tabs on Your Accounts
Stay vigilant and regularly check the activities of your accounts, particularly those with sensitive information.
Many services provide notifications when your account is accessed from a new device or unusual location. Pay attention to these alerts and act immediately if something looks fishy.
Similarly, if your credit card details end up in the wrong hands, contact your bank right away to lock the card.
How Locker’s Autofill Feature Balances Convenience with Security
Locker strikes a balance by providing the convenience of autofill without compromising on security.
Unlike some other tools, Locker doesn’t automatically give away your credentials. Its password autofill features only steps in when you’re on the original app or website for which you’ve saved the login details.
Even then, Locker requests your approval before auto-populating the login fields. This mechanism provides an added safety net, giving you a chance to verify the authenticity of the website or app you’re accessing.
Adding another layer of security, Locker also supports multi-factor authentication (MFA) right out of the box. This is an effective measure to further secure your digital life, and with it integrated into Locker, would-be attackers face a significantly tougher challenge.
Why wait for the worst to happen? Download Locker today and enjoy peace of mind with the convenience of secure autofill.
