There has been a recent series of articles and reported posts about Browsers and the risk of clickjacking, where bad actors manipulate a user’s activity by concealing objects beneath legitimate clickable content.
Clickjacking is also known as a “UI redress attack”. It typically involves multiple transparent or opaque layers to trick users into clicking on objects, such as buttons or links on another page, when they were intending to click on the top level page. The intent is to trick the user into;
- performing actions, such as entering their login credentials,
- entering their banking details, or
- loading a script of which they are unaware.
The bad actor is in effect “hijacking” clicks or keystrokes meant for a legitimate page and routing them, or the details entered, to another page that they control.
In lieu of this Click Studios has further enhanced the existing approaches to protecting your credentials with additional functionality in both our Browser Extensions and the Passwordstate core software.
Existing Approaches To Protection
But first, we should cover off on the existing protection available prior to Build 9972. Passwordstate has historically provided a range of features aimed at securing access to credentials via our Browser Extensions. This has included,
Confirmation of the Passwordstate Server URL.
This check ensures that your Browser Extension is connecting to the correct Passwordstate Instance. If the Browser Extension is red then the extension is unauthenticated and cannot retrieve or form-fill credentials,
To authenticate the Browser Extension requires you to login to your Passwordstate instance, click on the Browser Extension icon, and then confirm the Authentication URL matches the URL of your Passwordstate Instance that you have just logged into. If these match then you can enter your Browser Extension Master Password and click the Login button.
Reauthenticate Browser Extension on Opening.
When you close your Web browser, you will typically lock it and on reopening the Web Browser will have to reconfirm the URL, and enter your Master Password, to unlock the Browser Extension,
Note: Your Passwordstate Administrator may have configured Passwordstate to Auto Unlock the Browser Extension on Browser Startup. Organizations should consider both their operational requirements and perform a risk assessment before enabling the Auto Unlock feature.
Restrict Credential Types Being Accessed.
Your Passwordstate administrator can opt to block a number of credential types from being accessible via the Browser Extension. This includes Form Filling of OTP codes, blocking those Password records requiring Additional Authentication, and blocking Password Records requiring Check In/Out.
They can also set the strength policy that a user’s Master Password must adhere to.
New Protection in Build 9972
In Build 9972 we have further strengthened the options with our Browser Extension.
The first of these relates to Ask before form-filling credentials. If this is set by your Passwordstate Admin, then on browsing to a website where you only have one (1) saved credential, you will be prompted if you want to auto-fill that credential into the login input elements (image below, using Brave web browser),
If you have more than one saved credential for the website you’ll need to select the correct password record first, then you’ll be prompted if you want to form-fill those credentials.
The correct use, in either of these examples is,
- if you are prompted to auto-fill your credentials, but there are no visible login elements and your Browser Extension turns orange, you should stop what you are doing,
- double check the website you are about to form-fill is safe to use. Is the URL of the website the same as the URL displayed at the top of the prompt box? If you are uncertain then seek assistance from your Passwordstate administrator!
An example of the warning notification (Browser Extension turns orange) is shown below,
The above image is courtesy of https://websecurity.dev/password-managers/dom-based-extension-clickjacking/
The second of the new settings Globally disable Auto-Fill for all users will enable the Browser Extension to identify websites it has the matching credentials for, however they will not be automatically form-filled and the form-fill overlay will not be presented in the input elements. To fill these credentials, you will have to manually click on the Matching Login record in the Browser Extension (image below),
Basis of Protection
Our approach is based on heuristic protection to mitigate against known click-jacking techniques. When this is triggered the extension icon will turn orange and not form-fill as a precaution.
As always users should ensure they trust the website before providing any credentials.