Advertisers Are Exploiting Browser-Based Password Managers to Track Users

According to a new security report, Ad targeters are pulling your emails and other details by exploiting a loophole in your browser’s password manager. It is not only your browser’s built-in password manager that is affected but also third-party password manager add-ons for your browser like LastPass and 1Password.

The report from Princeton’s Center for Information Technology Policy, claims that third-party scripts have been caught exploiting browser login managers to extract user information from websites for the purpose of tracking Web activity.

The researchers examined two different scripts – AdThink and OnAudience – both of are designed to get identifiable information out of browser-based password managers. Here is how it works:

First, the user fills up login credentials on a certain website and asks the browser to save the information to its login managers. Once the user shifts to another page on the website, these scripts insert an invisible form, which then automatically gets filled by the embedded password manager. That information can then be used as a persistent ID to track users from page to page, a potentially valuable tool in targeting advertising.

This script collects browser features including plugins, MIME types, screen dimensions, language, timezone information, user agent string, OS, and CPU information. Princeton’s report contradicts OnAudience’s claim that it uses only anonymous data.

The plugins focus largely on the usernames, but according to the researchers, there is no technical measure to stop scripts from collecting passwords the same way. The only robust fix would be to change how password managers work, requiring more explicit approval before submitting information

If a publisher directly embeds a third-party script, rather than isolating it in an iframe, the script is treated as coming from the publisher’s origin. Thus, the publisher (and its users) entirely lose the protections of the same origin policy, and there is nothing preventing the script from exfiltrating sensitive information.

These scripts were found in 1110 of the Alexa top 1 million sites, which does not sound too troubling. But it is. Collecting passwords using the same technology may be next.

Currently, there is no fix planned by the companies behind your favorite browsers and Password managers. Therefore, if you are interested in securing your credentials and other data, then you should disable autologin and auto-fill in your browsers and password managers. Additionally, you can employ adblockers and tracking protection addons for your browser to prevent any such third-party tracking.

The full article, complete with a video that demos this vulnerability, is available at this link.