A good example of this would be the iCloud website which uses a login iframe from when signing in.įlashpoint does concede that 'the number of cases found matching this particular setup was quite low, reducing the potential risk.' What's more, Bitwarden not only has this auto-fill option disabled by default but also has a warning in the documentation that enabling it means a compromised site could take advantage to steal credentials. Here's what Bitwarden users need to know in light of a new report into one specific credential theft attack vector.Īn iframe is simply a method of embedding a page (or document if you prefer) within another HTML page, an inline frame. We've already seen examples of this erosion of trust in the case of LastPass recently, and now one of the other big password manager brands stands accused of not doing enough to prevent password theft. Which is why trust in these applications is so important and why that trust can get dented when responses to security researcher concerns appear less than reassuring. This is why, and I return to my opening gambit, password managers are seen by so many, including myself and the Straight Talking Cyber team at Forbes, as essential. With password reuse rife, and given the number of passwords we have it's hardly surprising, that unique, random, and complex passwords are key. Those who would wish to steal your money or data, be they your average cybercriminal or a state-sponsored team of hackers, look to credential compromise as a first port of call. Password managers are rightly seen by many security professionals as an essential part of your account takeover mitigation toolkit.

1password browser extension chrome