From cb92b8e24321c2b92d2fce531f2d6c1ccba0a552 Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Wed, 11 May 2022 14:51:28 +0000 Subject: [PATCH] add 0903 ref link Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission --- user.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index 0937912..c66a2df 100644 --- a/user.js +++ b/user.js @@ -400,7 +400,8 @@ user_pref("security.password_lifetime", 5); // [DEFAULT: 30] * can leak in cross-site forms *and* be spoofed * [NOTE] Username & password is still available when you enter the field * [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords - * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/ + * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ + * [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/ user_pref("signon.autofillForms", false); /* 0904: disable formless login capture for Password Manager [FF51+] ***/ user_pref("signon.formlessCapture.enabled", false);